CVE-2018-15563: Subrion CMS Stored Cross-site Scripting (XSS)
Summary
CVE-2018-15563: Subrion CMS Stored Cross-site Scripting (XSS). Affects intelliants/subrion versions < 4.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Subrion CMS is an open-source content management system that allows users to create and manage websites. It provides various features such as user management, content editing, and template customization. The vulnerability identified as CVE-2018-15563 affects Subrion CMS version 4.2.1. This version includes a flaw in the _core/admin/pages/add/ endpoint, specifically in the titles[en] parameter. This vulnerability exposes the system to cross-site scripting (XSS) attacks, which can lead to unauthorized access, data theft, and potential compromise of user accounts.
Vulnerability Detail
The vulnerability arises due to insufficient input sanitization in the titles[en] parameter. An attacker can inject malicious scripts into the parameter, which will be executed when the affected page is viewed by other users. This can result in the execution of arbitrary code, stealing of sensitive information, or manipulation of website content. The impact of this vulnerability is considered moderate, with a CVSS score of 6.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the titles[en] parameter before processing it. This can be achieved by implementing input validation and filtering techniques to remove or encode any potentially malicious content. Here is an example of how to sanitize the parameter using PHP:
$titles_en = filter_input(INPUT_POST, 'titles[en]', FILTER_SANITIZE_STRING);
Conclusion
In conclusion, the Subrion CMS version 4.2.1 is vulnerable to stored cross-site scripting (XSS) attacks due to insufficient input sanitization in the titles[en] parameter. Users are advised to upgrade to a patched version of Subrion CMS to mitigate this vulnerability. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for intelliants/subrion →
FAQ
Subrion CMS is an open-source content management system that allows users to create and manage websites. It provides various features such as user management, content editing, and template customization.
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to unauthorized access, data theft, and potential compromise of user accounts.
The CVSS score of this vulnerability is 6.1, indicating a moderate impact.
To fix this vulnerability, it is recommended to upgrade Subrion CMS to a version that includes a patch for this issue. The developers of Subrion CMS have released a fix in a subsequent version, which addresses the input sanitization flaw in the affected endpoint.
As a temporary workaround, users can manually sanitize the titles[en] parameter before processing it. This can be achieved by implementing input validation and filtering techniques to remove or encode any potentially malicious content.
Related vulnerabilities
Recent vulnerabilities recorded for intelliants/subrion.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
