Cross-Site Scripting Vulnerability in Subrion CMS v4.2.1
Summary
GHSA-9jjm-mc56-3qxv: Subrion CMS vulnerable to cross-site scripting. Affects intelliants/subrion versions < 4.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subrion CMS is an open-source content management system that allows users to create and manage websites with ease. It offers a range of features including customizable templates, plugins, and a user-friendly interface. However, version 4.2.1 of Subrion CMS has been identified to have multiple reflected Cross-Site Scripting (XSS) vulnerabilities, which can be exploited by attackers to execute arbitrary JavaScript in the context of the user's browser.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the installation module of Subrion CMS. Attackers can inject malicious scripts through the dbuser, dbpwd, and dbname parameters. When these parameters are reflected back to the user without proper sanitization, it allows the execution of arbitrary JavaScript code. This can lead to various malicious activities, including session hijacking, data theft, or redirecting users to malicious sites.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization for the dbuser, dbpwd, and dbname parameters to prevent the execution of malicious scripts. This can be done by escaping special characters and validating input against a whitelist of acceptable values.
Conclusion
The Cross-Site Scripting vulnerability in Subrion CMS v4.2.1 poses significant risks to users and their data. It is crucial to update to the latest version to mitigate these risks and ensure the security of your application.
See every vulnerability recorded for intelliants/subrion →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and security.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
The risks include unauthorized access to user sessions, data theft, and the potential for attackers to perform actions on behalf of the user.
Yes, updating to the latest version of Subrion CMS will patch this vulnerability. Ensure you follow the update instructions provided.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for intelliants/subrion.
