Weblication CMS Core / Grid 12.6.24 wFilemanager.php Title Persistent cross site scripting

Summaryinfo

A vulnerability identified as problematic has been detected in Weblication CMS Core and Grid 12.6.24. This vulnerability affects unknown code of the file wFilemanager.php. The manipulation of the argument Title leads to cross site scripting (Persistent). This vulnerability is documented as CVE-2018-13002. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Weblication CMS Core and Grid 12.6.24 (Content Management System) and classified as problematic. This issue affects some unknown functionality of the file wFilemanager.php. The manipulation of the argument Title with an unknown input leads to a cross site scripting vulnerability (Persistent). Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the `wFilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. The injection point is located in the Project `Title` and the execution point occurs in the `Inhaltsprojekte` output listing section. Remote attackers with privileged user accounts are able to inject their own malicious script code with a persistent attack vector to compromise user session credentials or to manipulate the affected web-application module output context. The request method to inject is POST.

The bug was discovered 02/21/2018. The weakness was released 06/29/2018 (Website). The advisory is shared at vulnerability-lab.com. The identification of this vulnerability is CVE-2018-13002 since 06/29/2018. The attack may be initiated remotely. A simple authentication is required for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 128 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:wFilemanager.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Vendor

• Weblication

Name

• CMS Core
• Grid

Version

• 12.6.24

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion