XenForo ToggleME 3.1.2 /admin.php options/list/toggleME cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, was found in XenForo ToggleME 3.1.2. This impacts an unknown function of the file /admin.php. The manipulation of the argument options/list/toggleME results in cross site scripting. The attack can be executed remotely. Additionally, an exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in XenForo ToggleME 3.1.2. It has been classified as problematic. Affected is some unknown functionality of the file /admin.php. The manipulation of the argument options/list/toggleME with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This is going to have an impact on confidentiality, and integrity.

The bug was discovered 09/06/2016. The weakness was released 09/11/2016 by Julien Ahrens (Agent) as not defined mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The exploitability is told to be easy. It is possible to launch the attack remotely. A authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1059.007.

After immediately, there has been an exploit disclosed. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:admin.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 3.1.4 eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• XenForo

Name

• ToggleME

Version

• 3.1.2

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion