Papoo CMS Light Multiple Cross Site Scripting Vulnerabilities
BID:49587
Info
Papoo CMS Light Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 49587 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 12 2011 12:00AM |
| Updated: | Sep 12 2011 12:00AM |
| Credit: | Stefan Schurtz |
| Vulnerable: |
Papoo Papoo CMS Light 4.0 |
| Not Vulnerable: |
Papoo Papoo CMS Light 4.05 |
Discussion
Papoo CMS Light Multiple Cross Site Scripting Vulnerabilities
Papoo CMS Light is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Papoo CMS Light 4.0 is vulnerable; other versions may also be affected.
Papoo CMS Light is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Papoo CMS Light 4.0 is vulnerable; other versions may also be affected.
Exploit / POC
Papoo CMS Light Multiple Cross Site Scripting Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URIs are available:
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URIs are available:
Solution / Fix
Papoo CMS Light Multiple Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references for more details.
Solution:
Updates are available. Please see the references for more details.
References
Papoo CMS Light Multiple Cross Site Scripting Vulnerabilities
References:
References: