concrete5 Multiple Security Vulnerabilities
BID:55415
Info
concrete5 Multiple Security Vulnerabilities
| Bugtraq ID: | 55415 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 05 2012 12:00AM |
| Updated: | Sep 05 2012 12:00AM |
| Credit: | Reported by the vendor and Martin Obiols from Secunia |
| Vulnerable: |
concrete5 concrete5 5.4.2 concrete5 concrete5 5.4.1 1 concrete5 concrete5 5.5.2.1 concrete5 concrete5 5.4.2.2 concrete5 concrete5 5.4.2.1 concrete5 concrete5 5.0.0b2 |
| Not Vulnerable: | |
Discussion
concrete5 Multiple Security Vulnerabilities
concrete5 is prone to multiple security vulnerabilities including:
1. An open-redirection vulnerability
2. A security-bypass vulnerability
3. Multiple cross-site scripting vulnerabilities
4. An SQL-injection vulnerability
An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, to bypass certain security restrictions and perform unauthorized actions, exploit latent vulnerabilities in the underlying database, and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Other attacks are also possible.
Versions prior to concrete5 5.6.0 are vulnerable.
concrete5 is prone to multiple security vulnerabilities including:
1. An open-redirection vulnerability
2. A security-bypass vulnerability
3. Multiple cross-site scripting vulnerabilities
4. An SQL-injection vulnerability
An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, to bypass certain security restrictions and perform unauthorized actions, exploit latent vulnerabilities in the underlying database, and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Other attacks are also possible.
Versions prior to concrete5 5.6.0 are vulnerable.
Exploit / POC
concrete5 Multiple Security Vulnerabilities
An attacker can exploit these issues with a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim to follow a malicious URI.
An attacker can exploit these issues with a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim to follow a malicious URI.
Solution / Fix
concrete5 Multiple Security Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
concrete5 Multiple Security Vulnerabilities
References:
References:
- concrete5 - 5.6.0 Release Notes (concrete5)
- Concrete5 Homepage (concrete5)