Geeklog 2.1.0: XSS

Geeklog 2.1.0: XSS

Date: 2015-12-02 11:14:18
Security Advisory – Curesec Research Team

1. Introduction

Affected Product: Geeklog 2.1.0
Fixed in: 2.1.1b3
Fixed Version Link:
Vendor Contact:
Vulnerability Type: XSS
Remote Exploitable: Yes
Reported to vendor: 09/29/2015
Disclosed to public: 12/02/2015
Release mode: Coordinated release
CVE: requested, but not assigned
Credits Tim Coen of curesec GmbH

2. Vulnerability Description


Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N


There is at least one XSS vulnerability in the installation script of Geeklog.

Geeklog recommends to delete the install directory and displays warnings in the admin area if this is not the case. However, deleting the install directory is not mandatory, so it should be assumed that not all users will delete it.

3. Proof of Concept

$_REQUEST['site_url'], $_REQUEST['site_admin_url'], and $_SERVER['PHP_SELF'] may be vulnerable as well, but the attacker would need a valid sql backup file to trigger them.

4. Solution

To mitigate this issue please upgrade at least to version 2.1.1b3:

Please note that a newer version might already be available.

5. Report Timeline

09/29/2015 Informed Vendor about Issue (no reply)
10/21/2015 Reminded Vendor of Disclosure Date
10/21/2015 Vendor asks for an additional two weeks for testing
11/17/2015 CVE Requested (no reply)
11/30/2015 Vendor releases fix
12/02/2015 Disclosed to public