Pixie CMS v1.04 (Contact form) POST XSS Vulnerabilities Vendor: Pixie CMS Product web page: http://www.getpixie.co.uk Affected version: 1.04 Severity: Medium CVE: CVE-2014-3786 Demo page: http://demo.getpixie.co.uk Discovered by: Filippos Mastrogiannis (@filipposmastro) & Simone Memoli (@Simon90_Italy) Pixie is a free, open source CMS software a.k.a a small, simple, website maker (as the vendor states on its website) Description: Pixie (v1.04) suffers from several POST XSS vulnerabilities in the Contact form (contact.php). The user input through the POST parameters 'uemail' and 'subject' are not properly sanitized allowing the attacker to execute HTML code into user's browser session on the affected site. The vulnerable component is the contact module of the Pixie v1.04 and it can be found at (/pixie_v1.04/admin/modules/contact.php) of the source code Tested on: Ubuntu 13.10 with Mozilla Firefox 29.0 / Microsoft Windows 7 with Mozilla Firefox 29.0.1 Proof Of Concept: Pixie CMS v1.04 Contact form (uemail parameter) XSS
Pixie CMS v1.04 Contact form (subject parameter) XSS
Disclosure Timeline: [13.05.2014] Vulnerabilities discovered. [13.05.2014] Initial contact with the vendor. [15.05.2014] 1st response from the official maintainer. [30.05.2014] 2nd response from the official maintainer. [30.05.2014] Public security advisory released.