What this actually is.
Technical background, root cause, and affected surface.
Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) email or (2) username parameter to index.php.
- Vendor
- Symphony
- Affected Product
- Symphony
- CVE
- CVE-2015-8766
- Securin ID
- 2015-CSW-08-1001
- Status
- Fixed
- Date
- November 3, 2015
- Severity
- Medium
- CVSS Score
- 6.1
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Issue 1: The POST Request of the variable email_sendmail[from_name] in the preference form is vulnerable to XSS. Similarly, the rest of the variables are also vulnerable.
Note: Similarly, all the other mentioned variables are vulnerable to Cross-Site Scripting (XSS)
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
● User’s session cookie & end-user files disclosure.
● Hijack the user’s session & take over the account.
● Installation of Trojan horse programs.
● Redirection of the user to some other page or site.
● Modification to the presentation of content.
● Malicious script permanently stored on the server.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Download and apply the following patch provided by the vendor:
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vulnerability Discovered in Symphony CMS
Reported to Vendor
Vendor Response
Vendor Released Fixed version
Public Disclosed
CVE Assigned
Disclosed 38 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.