SyndeoCMS Cross Site Scripting and Local File Include Vulnerabilities

Bugtraq ID:	29644
Class:	Input Validation Error
CVE:	CVE-2008-5272 CVE-2008-5271
Remote:	Yes
Local:	No
Published:	Jun 10 2008 12:00AM
Updated:	Jul 06 2016 02:17PM
Credit:	CWH Underground
Vulnerable:	SyndeoCMS SynedoCMS 2.6 SyndeoCMS SyndeoCMS 2.5.1
Not Vulnerable:	SyndeoCMS SynedoCMS 2.6.2

SyndeoCMS Cross Site Scripting and Local File Include Vulnerabilities

SyndeoCMS is prone to multiple local file-include vulnerabilities and a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Exploiting the local file-include issues allows remote attackers to view local files within the context of the webserver process.

SyndeoCMS 2.6.0 is vulnerable; other versions may also be affected.

SyndeoCMS Cross Site Scripting and Local File Include Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URIs are available:

• /data/vulnerabilities/exploits/29644.html

SyndeoCMS Cross Site Scripting and Local File Include Vulnerabilities

Solution:
The vendor has released an update to address this issue. See the references for more information.

SyndeoCMS Cross Site Scripting and Local File Include Vulnerabilities

References:

• SyndeoCMS Home Page (SyndeoCMS)
  
• Topic: Security update (SyndeoCMS)