Baseline CMS Multiple Input Validation Vulnerabilities

Bugtraq ID:	15961
Class:	Input Validation Error
CVE:	CVE-2005-4378
Remote:	Yes
Local:	No
Published:	Dec 19 2005 12:00AM
Updated:	Jan 11 2008 11:59PM
Credit:	r0t is credited with the discovery of this vulnerability.
Vulnerable:	Baseline CMS Baseline CMS 1.95
Not Vulnerable:

Baseline CMS Multiple Input Validation Vulnerabilities

Baseline CMS is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.

A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, steal cookie-based authentication credentials, and launch other attacks.

Baseline CMS Multiple Input Validation Vulnerabilities

No exploit is required.

Example URIs have been provided:

http://www.example.com/Page.asp?PageID=[XSS]
http://www.example.com/Page.asp?PageID=1&SiteNodeID=[XSS]
http://www.example.com/Page.asp?PageID=1&SiteNodeID=[SQL]

Baseline CMS Multiple Input Validation Vulnerabilities

Solution:
The vendor released fixes to address these issues. Please contact the vendor for information on how to obatin and apply the fixes.

Baseline CMS Multiple Input Validation Vulnerabilities

References:

• Baseline CMS vuln. (r0t)
  
• Baseline CMS Web Site (Baseline CMS )