CVE-2019-7173: Croogo vulnerable to Cross-site Scripting in title field
Summary
CVE-2019-7173: Croogo vulnerable to Cross-site Scripting in title field. Affects croogo/croogo versions < 3.0.7. Fixed in 3.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Croogo is a package available on Packagist that provides a content management system (CMS) for building websites. It offers various features such as user management, content creation, and file management. However, versions before 3.0.7 are susceptible to a Cross-site Scripting (XSS) vulnerability in the Title field of the file manager's attachment editing functionality.
Vulnerability Detail
The vulnerability allows an attacker to perform a stored self-XSS attack by injecting malicious HTML or JavaScript code into the Title field. This can be exploited through the /admin/file-manager/attachments/edit/4 endpoint. If a user with higher privileges, such as an administrator, views the affected attachment, the injected code will execute in their browser, potentially leading to unauthorized actions or data theft.
How To Fix
Minimum fixed version
3.0.7
This is the first release that contains the fix.
composer require croogo/croogo:3.0.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can sanitize the input in the Title field to remove any potentially harmful HTML or JavaScript code. This can be done by implementing input validation and filtering techniques. Here is an example of how to sanitize the Title field using PHP:
$title = strip_tags($title);
Conclusion
In conclusion, Croogo versions before 3.0.7 are vulnerable to a Cross-site Scripting (XSS) attack in the Title field of the file manager's attachment editing functionality. To mitigate this vulnerability, it is recommended to upgrade to version 3.0.7 or later. Additionally, input validation and filtering techniques can be implemented as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for croogo/croogo →
FAQ
Croogo is a content management system (CMS) package available on Packagist. It provides features for building websites, managing users, creating content, and handling file attachments.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized actions, data theft, or the spread of malware.
The vulnerability in Croogo allows an attacker to execute malicious code in the browser of a user with higher privileges, such as an administrator. This can lead to unauthorized actions being performed on the website or the theft of sensitive data.
Yes, the vulnerability can be fixed by upgrading Croogo to version 3.0.7 or later. This version includes a patch that prevents the execution of malicious code in the Title field.
As a temporary workaround, users can sanitize the input in the Title field to remove any potentially harmful HTML or JavaScript code. This can be done by implementing input validation and filtering techniques.
References
Related vulnerabilities
Recent vulnerabilities recorded for croogo/croogo.
