← Advisories

Gecko CMS 2.3 Multiple Vulnerabilities

Medium
Advisory ID
ZSL-2015-5222
Release Date
12 January 2015
Vendor
JAKWEB - http://www.cmsgecko.com
Affected Version
2.3 and 2.2
CVE
CVE-2015-1422, CVE-2015-1423, CVE-2015-1424
Tested On
Apache/2, PHP/5.4.36
Summary

Gecko CMS is the way to go, forget complicated, bloated and slow content management systems, Gecko CMS has been build to be intuitive, easy to use, extendable to almost anything, running on all standard web hosting (PHP and one MySQL database, Apache is a plus), browser compatibility and fast, super fast!

Description

Gecko CMS suffers from multiple vulnerabilities including Cross-Site Request Forgery, Stored and Reflected Cross-Site Scripting and SQL Injection.

Proof of Concept
geckocms_mv.txtTXT
Disclosure Timeline
27.12.2014Vulnerabilities discovered.
05.01.2015Vendor contacted.
06.01.2015Vendor responds asking more details.
06.01.2015Sent details to the vendor.
06.01.2015Vendor confirms issues but is not going to develop a fix because the issues are present in the admin panel (authd).
12.01.2015Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
[1]http://www.exploit-db.com/exploits/35767/
[2]http://packetstormsecurity.com/files/129929
[3]http://cxsecurity.com/issue/WLB-2015010058
[4]http://osvdb.org/show/osvdb/116966
[5]http://osvdb.org/show/osvdb/116967
[6]http://osvdb.org/show/osvdb/116968
[7]http://osvdb.org/show/osvdb/116969
[8]http://osvdb.org/show/osvdb/116970
[9]http://www.securityfocus.com/bid/72085
[10]http://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-1422
[11]http://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-1423
[12]http://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-1424
[13]http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1422
[14]http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1423
[15]http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1424
[16]http://xforce.iss.net/xforce/xfdb/99974
[17]http://xforce.iss.net/xforce/xfdb/99975
[18]http://xforce.iss.net/xforce/xfdb/99976
[19]http://xforce.iss.net/xforce/xfdb/99977
Changelog
12.01.2015Initial release
14.01.2015Added reference [1], [2], [3], [4], [5], [6], [7] and [8]
23.01.2015Added reference [9]
30.01.2015Added reference [10], [11], [12], [13], [14], [15], [16], [17], [18] and [19]