← Advisories

Lunar CMS 3.3 CSRF And Stored XSS Vulnerability

Medium
Advisory ID
ZSL-2014-5188
Release Date
21 June 2014
Vendor
Affected Version
3.3
Tested On
Apache/2.4.7 (Win32), PHP/5.5.6, MySQL 5.6.14
Summary

Lunar CMS is a freely distributable open source content management system written for use on servers running the ever so popular PHP5 & MySQL.

Description

Lunar CMS suffers from a cross-site request forgery and a stored xss vulnerabilities. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Input passed to the 'subject' and 'email' POST parameters thru the 'Contact Form' extension/module is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Proof of Concept
Disclosure Timeline
11.06.2014Vulnerabilities discovered.
12.06.2014Vendor contacted.
12.06.2014Vendor replies asking more details.
12.06.2014Sent details to the vendor.
12.06.2014Vendor confirms the vulnerabilities.
13.06.2014Working with the vendor.
19.06.2014Vendor releases fixed version 3.3-3 to address these issues.
21.06.2014Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
21.06.2014Initial release
24.06.2014Added reference [2], [3], [4], [5], [6] and [7]
25.06.2014Added reference [8]
03.07.2014Added reference [9] and [10]
05.07.2014Added reference [11] and [12]