← Advisories

u5CMS 3.9.3 Multiple Stored And Reflected XSS Vulnerabilities

Medium
Advisory ID
ZSL-2015-5223
Release Date
09 February 2015
Vendor
Stefan P. Minder - http://www.yuba.ch
Affected Version
3.9.3 and 3.9.2
CVE
CVE-2015-1575
Tested On
Apache 2.4.10 (Win32), PHP 5.6.3, MySQL 5.6.21
Summary

u5CMS is a little, handy Content Management System for medium-sized websites, conference / congress / submission administration, review processes, personalized serial mails, PayPal payments and online surveys based on PHP and MySQL and Apache.

Description

u5CMS suffers from multiple stored and reflected cross-site scripting vulnerabilities. Input passed to several POST and GET parameters is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Proof of Concept
u5cms_xss.txtTXT
Disclosure Timeline
29.12.2014Vulnerabilities discovered.
04.02.2015Contact with the vendor.
04.02.2015Vendor replies asking more details.
05.02.2015Sent details to the vendor.
06.02.2015Vendor releases version 3.9.4 to address these issues.
09.02.2015Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
[1]http://yuba.ch/index.php?c=u5cms&l=en
[2]http://www.exploit-db.com/exploits/36029
[3]http://xforce.iss.net/xforce/xfdb/100775
[4]http://xforce.iss.net/xforce/xfdb/100776
[5]http://packetstormsecurity.com/files/130292
[6]http://osvdb.org/show/osvdb/118127
[7]http://osvdb.org/show/osvdb/118126
[8]http://osvdb.org/show/osvdb/118125
[9]http://osvdb.org/show/osvdb/118124
[10]http://osvdb.org/show/osvdb/118123
[11]http://osvdb.org/show/osvdb/118122
[12]http://osvdb.org/show/osvdb/118121
[13]http://osvdb.org/show/osvdb/118120
[14]http://osvdb.org/show/osvdb/118119
[15]http://osvdb.org/show/osvdb/118118
[16]http://osvdb.org/show/osvdb/118117
[17]http://osvdb.org/show/osvdb/118116
[18]http://osvdb.org/show/osvdb/118115
[19]http://osvdb.org/show/osvdb/118107
[20]http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1575
[21]http://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-1575
Changelog
09.02.2015Initial release
11.02.2015Added reference [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16], [17], [18] and [19]
12.02.2015Added reference [20] and [21]