Xoops XSS

Xoops XSS

Date: 2016-01-28 09:47:11
Security Advisory – Curesec Research Team

1. Introduction

Affected Product: Xoops
Fixed in: Patch
Patch Link: http://xoops.org/modules/news/article.php?storyid=6747
Vendor Website: http://xoops.org/
Vulnerability Type: XSS
Remote Exploitable: Yes
Reported to vendor: 11/21/2015
Disclosed to public: 01/28/2016
Release mode: Coordinated Release
CVE: requested, but not assigned
Credits Tim Coen of Curesec GmbH

2. Overview

Xoops is a content management system written in PHP. In version, it is vulnerable to reflected and persistent XSS.

The vulnerability can lead to the stealing of cookies, injection of JavaScript keyloggers, or the bypassing of CSRF protection.

3. Details

Persistent XSS

CVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Description: Comment messages are echoed unencoded leading to persistent XSS. A user account is needed, but registration is open by default.

Proof of Concept:

0. Register (registration is open by default) 1. Leave a Comment, as Message use '">xss<img src=no onerror=alert(1)> 2. Visit the comment overview to trigger the XSS: http://localhost/xoops-

Reflected XSS 1

CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Description: The path_file and file parameters of the jquery.php script are vulnerable to reflected XSS.

Proof of Concept:


Reflected XSS 2

CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Description: The URL is echoed unencoded when viewing users in the admin area, leading to reflected XSS.

Proof of Concept:


4. Solution

To mitigate this issue please apply the security patch:


Please note that a newer version might already be available.

5. Report Timeline

11/21/2015 Informed Vendor about Issue (no reply)
12/10/2015 CVE requested, but not assigned
12/10/2015 Reminded Vendor of Disclosure Date
12/11/2015 Vendor requests more time
01/02/2016 Vendor releases patch
01/28/2016 Disclosed to public