chillyCMS SQL Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	42991
Class:	Input Validation Error
CVE:	CVE-2010-4894 CVE-2010-4895
Remote:	Yes
Local:	No
Published:	Sep 05 2010 12:00AM
Updated:	Oct 11 2011 10:20PM
Credit:	AmnPardaz Security Research & Penetration Testing Group
Vulnerable:	chillyCMS chillyCMS 1.1.3
Not Vulnerable:

chillyCMS SQL Injection and Cross Site Scripting Vulnerabilities

chillyCMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

chillyCMS 1.1.3 is vulnerable; other versions may also be affected.

chillyCMS SQL Injection and Cross Site Scripting Vulnerabilities

Attackers can use a browser to exploit these issues.

chillyCMS SQL Injection and Cross Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

chillyCMS SQL Injection and Cross Site Scripting Vulnerabilities

References:

• chillyCMS Homepage (chillyCMS)
  
• chillyCMS Multiple Vulnerabilities (chillyCMS)