[+] Credits: John Page ( hyp3rlinx )
[+] Domains: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-SYMPHONY0606.txt
Symphony CMS 2.6.2
Symphony CMS XSS Vulnerability
The 'sort' parameter used by author search in Admin is XSS exploitable. Symphony seems to escape injected strings
e.g. 'HELL' becomes \'HELL\' but we can easily defeat that using Javascript functions charCodeAt() & fromCharCode()
e.g.
String.fromCharCode(72,69,76,76)
Now we can output our 'HELL' strings, construct URLs etc…
Vendor Notification: June 5, 2015
June 6, : Public Disclosure
Med
Request Method(s):
[+] GET
Vulnerable Product:
[+] Symphony CMS 2.6.2
Vulnerable Parameter(s):
[+] sort
Affected Area(s):
[+] symphony/system/authors/
===============================================================
(hyp3rlinx)