Summaryinfo

A vulnerability classified as problematic has been found in Croogo 2.0.0. The affected element is an unknown function. Performing a manipulation of the argument data[Link][title] results in cross site scripting. This vulnerability is identified as CVE-2014-8577. The attack can be initiated remotely. Additionally, an exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Croogo 2.0.0. It has been classified as problematic. This affects some unknown processing. The manipulation of the argument data[Link][title] with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Contact][title] parameter to admin/contacts/contacts/add page; (2) data[Block][title] or (3) data[Block][alias] parameter to admin/blocks/blocks/edit page; (4) data[Region][title] parameter to admin/blocks/regions/add page; (5) data[Menu][title] or (6) data[Menu][alias] parameter to admin/menus/menus/add page; or (7) data[Link][title] parameter to admin/menus/links/add/menu page.

The weakness was released 10/31/2014 (Website). It is possible to read the advisory at blog.croogo.org. This vulnerability is uniquely identified as CVE-2014-8577 since 10/31/2014. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 2.0.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (96991), Exploit-DB (34959) and OSVDB (113109†). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Croogo

Version

• 2.0.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion