AlexanderLivanov FotosCMS2 Cookie profile.php cross site scripting

Vulnerability

In FotosCMS2 versions up to 2.4.3, the profile.php file echoes the session username ($_SESSION['username']) without sanitization. This session variable is set from the username cookie cookie in cfg.php via $_COOKIE['username cookie']. An attacker can control this cookie value, leading to a stored/reflected cross-site scripting (XSS) vulnerability. The affected code path is reachable whenever a user accesses profile.php with a crafted cookie. [1]

Exploitation

An attacker can set a malicious username cookie containing JavaScript payload (e.g., `). By enticing a victim to visit profile.php` with that cookie set (e.g., via a crafted link or social engineering), the payload executes in the victim's browser. No authentication is required for the attacker to craft the cookie, but the victim must have the cookie present when accessing the page. [1]

Impact

Successful exploitation allows arbitrary JavaScript execution in the victim's browser within the context of the FotosCMS2 site. This can lead to session hijacking, defacement, credential theft, or redirection to malicious sites. The attacker gains the victim's session privileges and can perform actions on behalf of the victim. [1]

Mitigation

The FotosCMS2 repository was archived by the owner on March 15, 2024, and is now read-only. No official patch has been released. Users should consider migrating to an alternative CMS or manually sanitizing the username cookie input before outputting it in profile.php. As of the publication date, this vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog. [1]