CMS Made Simple Unspecified Cross-Site Scripting Vulnerability
BID:61373
Info
CMS Made Simple Unspecified Cross-Site Scripting Vulnerability
| Bugtraq ID: | 61373 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 21 2013 12:00AM |
| Updated: | Jul 21 2013 12:00AM |
| Credit: | LEAKFREE IT Security |
| Vulnerable: |
CMS Made Simple CMS Made Simple 1.9.4 1 CMS Made Simple CMS Made Simple 1.7.1 CMS Made Simple CMS Made Simple 1.7 CMS Made Simple CMS Made Simple 1.6.6 CMS Made Simple CMS Made Simple 1.6.3 CMS Made Simple CMS Made Simple 1.6.2 CMS Made Simple CMS Made Simple 1.5.1 CMS Made Simple CMS Made Simple 1.4.1 CMS Made Simple CMS Made Simple 1.2.5 CMS Made Simple CMS Made Simple 1.2.4 CMS Made Simple CMS Made Simple 1.2.2 CMS Made Simple CMS Made Simple 1.1.2 CMS Made Simple CMS Made Simple 1.0.3 CMS Made Simple CMS Made Simple 1.0.2 CMS Made Simple CMS Made Simple 1.9.4.3 CMS Made Simple CMS Made Simple 1.9.1 CMS Made Simple CMS Made Simple 1.9.0 CMS Made Simple CMS Made Simple 1.8 CMS Made Simple CMS Made Simple 1.5 CMS Made Simple CMS Made Simple 1.10.3 CMS Made Simple CMS Made Simple 1.1.4.1 CMS Made Simple CMS Made Simple 1.1.3.1 CMS Made Simple CMS Made Simple 1.06 CMS Made Simple CMS Made Simple 1.05 |
| Not Vulnerable: | |
Discussion
CMS Made Simple Unspecified Cross-Site Scripting Vulnerability
CMS Made Simple is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to CMS Made Simple 1.11.7 are vulnerable.
CMS Made Simple is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to CMS Made Simple 1.11.7 are vulnerable.
Exploit / POC
CMS Made Simple Unspecified Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
CMS Made Simple Unspecified Cross-Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
CMS Made Simple Unspecified Cross-Site Scripting Vulnerability
References:
References:
- CMS Made Simple Homepage (CMS Made Simple)