Jupiter CMS Multiple Input Validation Vulnerabilities

Bugtraq ID:	20048
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 15 2006 12:00AM
Updated:	Sep 16 2006 12:02AM
Credit:	HACKERS PAL has been credited with the discovery of these vulnerabilities.
Vulnerable:	Jupiter CMS Jupiter CMS 1.1.5 Jupiter CMS Jupiter CMS 1.1.4
Not Vulnerable:

Jupiter CMS Multiple Input Validation Vulnerabilities

Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.

Jupiter CMS Multiple Input Validation Vulnerabilities

Attackers can exploit these issues via a web client:

The following proofs of concept are available:

• /data/vulnerabilities/exploits/20048.html

Jupiter CMS Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Jupiter CMS Multiple Input Validation Vulnerabilities

References:

• Jupiter Homepage (Jupiterportal.com)
  
• Jupiter CMS Multiple injections ([email protected])