benja CMS Multiple Input Validation and Unauthorized Access Vulnerabilities
BID:29884
Info
benja CMS Multiple Input Validation and Unauthorized Access Vulnerabilities
| Bugtraq ID: | 29884 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-2988 CVE-2008-2879 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 23 2008 12:00AM |
| Updated: | Jul 05 2016 10:01PM |
| Credit: | CWH Underground |
| Vulnerable: |
benja CMS benja CMS 0.1 |
| Not Vulnerable: | |
Discussion
benja CMS Multiple Input Validation and Unauthorized Access Vulnerabilities
The 'benja CMS' program is prone to multiple vulnerabilities because it fails to adequately validate input and restrict access. These issues include three cross-site scripting issues, an arbitrary-file-upload issue, and a vulnerability that allows unauthorized access to an administrative script.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, to run arbitrary script code in the context of the application, or to access administrative scripts.
These issues affect 'benja CMS 0.1'; other versions may also be affected.
The 'benja CMS' program is prone to multiple vulnerabilities because it fails to adequately validate input and restrict access. These issues include three cross-site scripting issues, an arbitrary-file-upload issue, and a vulnerability that allows unauthorized access to an administrative script.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, to run arbitrary script code in the context of the application, or to access administrative scripts.
These issues affect 'benja CMS 0.1'; other versions may also be affected.
Exploit / POC
benja CMS Multiple Input Validation and Unauthorized Access Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim user to follow a malicious URI.
The following example URIs are available:
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim user to follow a malicious URI.
The following example URIs are available:
Solution / Fix
benja CMS Multiple Input Validation and Unauthorized Access Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
benja CMS Multiple Input Validation and Unauthorized Access Vulnerabilities
References:
References: