CVE-2015-2678

Vulnerability

GeniXCMS versions before 0.0.2 are vulnerable to multiple reflected cross-site scripting (XSS) attacks. The cat parameter on the categories page (gxadmin/index.php) and the page parameter on index.php are not properly sanitized before being output, allowing injection of arbitrary HTML and JavaScript [1][4]. The vulnerability affects all installations prior to the 0.0.2 release.

Exploitation

An attacker can exploit these vulnerabilities by crafting a malicious URL containing a payload in the cat or page parameter. No authentication is required for the page parameter on index.php; the cat parameter requires access to the admin categories page, but no special privileges beyond that. The attacker can trick a victim into clicking the crafted link, or if the victim is an admin, the XSS can be triggered directly [1][4].

Impact

Successful exploitation allows an attacker to execute arbitrary script in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites. The impact is limited to the client side, but if an admin is targeted, the attacker could potentially perform administrative actions via XSS [1][4].

Mitigation

The vulnerability is fixed in GeniXCMS version 0.0.2, released on or before March 2015 [2]. Users should upgrade to 0.0.2 or later. The commit [2] shows the sanitization of output and addition of CSRF tokens. No workaround is provided for earlier versions. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.