CruxCMS Multiple Input Validation Vulnerabilities
BID:45594
Info
CruxCMS Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 45594 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 26 2010 12:00AM |
| Updated: | Dec 26 2010 12:00AM |
| Credit: | ToXiC, y3dips, Sm0ke, Heintz, slimjim100, pexli, zerobytes and vince213333 |
| Vulnerable: |
Crux Software CruxCMS 3.0 |
| Not Vulnerable: | |
Discussion
CruxCMS Multiple Input Validation Vulnerabilities
CruxCMS is prone to multiple input-validation vulnerabilities, including multiple security-bypass issues, multiple arbitrary-file-upload issues, multiple SQL-injection issues, a local file-include issue, a cross-site-scripting issue and multiple information-disclosure issues. These issues occur because the application fails to properly sanitize user-supplied input.
Exploiting these issues may allow an unauthorized user to view files and execute local scripts, execute arbitrary script code, bypass certain security restrictions, access or modify data, exploit latent vulnerabilities in the underlying database, gain administrative access, steal cookie-based authentication credentials, and launch other attacks.
CruxCMS 3.0.0 is vulnerable; other versions may also be affected.
CruxCMS is prone to multiple input-validation vulnerabilities, including multiple security-bypass issues, multiple arbitrary-file-upload issues, multiple SQL-injection issues, a local file-include issue, a cross-site-scripting issue and multiple information-disclosure issues. These issues occur because the application fails to properly sanitize user-supplied input.
Exploiting these issues may allow an unauthorized user to view files and execute local scripts, execute arbitrary script code, bypass certain security restrictions, access or modify data, exploit latent vulnerabilities in the underlying database, gain administrative access, steal cookie-based authentication credentials, and launch other attacks.
CruxCMS 3.0.0 is vulnerable; other versions may also be affected.
Exploit / POC
CruxCMS Multiple Input Validation Vulnerabilities
Attackers can exploit these issues via a browser. To exploit the cross-site scripting issue, the attacker must trick a victim into following a malicious URI.
The following example URIs are available:
Attackers can exploit these issues via a browser. To exploit the cross-site scripting issue, the attacker must trick a victim into following a malicious URI.
The following example URIs are available:
Solution / Fix
CruxCMS Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
CruxCMS Multiple Input Validation Vulnerabilities
References:
References: