Webers CMS Multiple Input Validation Vulnerabilities
BID:63579
Info
Webers CMS Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 63579 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 05 2013 12:00AM |
| Updated: | Nov 05 2013 12:00AM |
| Credit: | Hossein Hezami |
| Vulnerable: |
WEBERS.gr Webers CMS 0 |
| Not Vulnerable: | |
Discussion
Webers CMS Multiple Input Validation Vulnerabilities
Webers CMS is prone to the following input-validation vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. Multiple SQL-injection vulnerabilities
3. A local file-include vulnerability
Exploiting these issues can allow an attacker to steal cookie-based authentication credentials, view local files within the context of the webserver, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
Webers CMS is prone to the following input-validation vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. Multiple SQL-injection vulnerabilities
3. A local file-include vulnerability
Exploiting these issues can allow an attacker to steal cookie-based authentication credentials, view local files within the context of the webserver, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
Exploit / POC
Webers CMS Multiple Input Validation Vulnerabilities
An attacker can exploit these issues using a web browser. To exploit a cross-site scripting vulnerabilities, the attacker must entice an unsuspecting user into visiting a malicious URI.
An attacker can exploit these issues using a web browser. To exploit a cross-site scripting vulnerabilities, the attacker must entice an unsuspecting user into visiting a malicious URI.
Solution / Fix
Webers CMS Multiple Input Validation Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].