Summary

fileurl parameter is not properly sanitized when saving external links in links.php . Morever, the said fileurl is placed in some html code which is passed to the print function in link.php and index.php, finally leading to stored XSS.

Details

Users with the privilege to create external links can manipulate the fileurl parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping.

The screenshot below shows that the tester entered the payload below to prove the existence of the XSS vulnerability by leaking the cookies of the victim user.

Payload: http://127.0.0.1/cla" onmouseover="alert('XSS:'+document.cookie)"

The screenshot below shows the http post request that was sent. As seen, the payload resides in the fileurl parameter.

The screenshot below shows that after creating the external link, simply going to the main page triggers the vulnerability. As seen, an alert box is popped up showing the cookies thereby proving the existence of the stored XSS vulnerability.

The following screenshots show the vulnerable codes in the afforementioned php files.

• In links.php (during save)

• In link.php (during viewing via the link.php)

• In index.php (during viewing via the index.php)

PoC

Payload: http://127.0.0.1/cla" onmouseover="alert('XSS:'+document.cookie)"

• Go to External Links under Utilities menu.
• Click on + sign to add a new external link.
• Choose Top of Console Page as style.
• Give a Tab/Menu Name.
• Add the payload to Web URL Location (the text field is fileurl parameter) field.
• Click on save.
• Finally, either click on Main Console (index.php) to trigger the XSS or click on View Page button on the External Links (link.php) page.

Impact

Performing actions on the web application on behalf of other users such as admin user.