e107 CMS 'submitnews.php' Multiple HTML Injection Vulnerabilities
BID:28982
Info
e107 CMS 'submitnews.php' Multiple HTML Injection Vulnerabilities
| Bugtraq ID: | 28982 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-6208 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 29 2008 12:00AM |
| Updated: | May 07 2015 05:29PM |
| Credit: | Dir31 |
| Vulnerable: |
e107 e107 website system 0.7.11 |
| Not Vulnerable: | |
Discussion
e107 CMS 'submitnews.php' Multiple HTML Injection Vulnerabilities
e107 CMS is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
Attacker-supplied HTML and script code could execute in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
These issues affect e107 CMS 0.7.11; other versions may also be vulnerable.
e107 CMS is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
Attacker-supplied HTML and script code could execute in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
These issues affect e107 CMS 0.7.11; other versions may also be vulnerable.
Exploit / POC
e107 CMS 'submitnews.php' Multiple HTML Injection Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting user to visit a malicious website.
Attackers can exploit these issues by enticing an unsuspecting user to visit a malicious website.
Solution / Fix
e107 CMS 'submitnews.php' Multiple HTML Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
e107 CMS 'submitnews.php' Multiple HTML Injection Vulnerabilities
References:
References:
- e107 CMS Homepage (e107)