Cross-Site Scripting in SeaCMS up to 13.6

Executive Summary

This vulnerability is a reflected Cross-Site Scripting (XSS) flaw in SeaCMS version 13.6. It exists in the err.php file where the errtxt parameter is improperly handled. The parameter is reflected inside a textarea tag without proper HTML escaping, allowing attackers to inject malicious scripts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect SeaCMS installations for the err.php file and check if the errtxt parameter is reflected without proper HTML escaping. Manually test by appending a payload like ?errtxt=test%3C/script%3E%3Ciframe/src=x%3E to the URL and observe if arbitrary code executes. Use tools like curl or browser developer tools to inspect responses for unsanitized input.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to inject and execute malicious scripts in a victim's browser when they visit a specially crafted link. This could lead to session hijacking, defacement, or theft of sensitive data like cookies or credentials.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability, a reflected XSS flaw in SeaCMS, could potentially impact compliance with GDPR and HIPAA by exposing user data to unauthorized access or manipulation. XSS attacks may lead to data breaches, which are reportable under GDPR and could violate HIPAA's safeguards for protected health information if exploited in healthcare systems.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update SeaCMS to a patched version if available. As a temporary fix, apply htmlspecialchars() to the errtxt parameter output in err.php. Implement server-side input validation to reject scripts or HTML tags. Add a strict Content Security Policy (CSP) to block javascript: URIs in iframes and other dangerous sources.

Useful 0 Not Useful 0