Anantasoft Gazelle CMS Multiple Input Validation Vulnerabilities
BID:42623
Info
Anantasoft Gazelle CMS Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 42623 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 23 2010 12:00AM |
| Updated: | Aug 23 2010 12:00AM |
| Credit: | Sweet |
| Vulnerable: |
Anantasoft Gazelle CMS 1.0 |
| Not Vulnerable: | |
Discussion
Anantasoft Gazelle CMS Multiple Input Validation Vulnerabilities
Anantasoft Gazelle CMS is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include a local file-include vulnerability and multiple cross-site-scripting vulnerabilities.
Exploiting these issues can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, obtain potentially sensitive information, and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
Anantasoft Gazelle CMS 1.0 is vulnerable; other versions may be affected.
NOTE: One or more of these issues may be related to one of the issues described in BID 33483 or BID 38730.
Anantasoft Gazelle CMS is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include a local file-include vulnerability and multiple cross-site-scripting vulnerabilities.
Exploiting these issues can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, obtain potentially sensitive information, and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
Anantasoft Gazelle CMS 1.0 is vulnerable; other versions may be affected.
NOTE: One or more of these issues may be related to one of the issues described in BID 33483 or BID 38730.
Exploit / POC
Anantasoft Gazelle CMS Multiple Input Validation Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user into visiting a malicious URI.
The following example URIs are available:
http://www.example.com/AnantaPatch/admin/index.php?template=../../../../../../../../../../boot.ini%00
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user into visiting a malicious URI.
The following example URIs are available:
http://www.example.com/AnantaPatch/admin/index.php?template=../../../../../../../../../../boot.ini%00
Solution / Fix
Anantasoft Gazelle CMS Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Anantasoft Gazelle CMS Multiple Input Validation Vulnerabilities
References:
References:
- Anantasoft - Homnepage (Anantasoft)