Redaxo Multiple Security Vulnerabilities
BID:63630
Info
Redaxo Multiple Security Vulnerabilities
| Bugtraq ID: | 63630 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 09 2013 12:00AM |
| Updated: | Nov 09 2013 12:00AM |
| Credit: | Root User |
| Vulnerable: |
REDAXO REDAXO 4.5 |
| Not Vulnerable: | |
Discussion
Redaxo Multiple Security Vulnerabilities
Redaxo is prone to the following remote security vulnerabilities:
1. A local file-include vulnerability
2. Multiple arbitrary code-execution vulnerabilities
3. Multiple cross-site scripting vulnerabilities
4. An arbitrary file-upload vulnerability
Attackers can exploit these issues to execute arbitrary code, upload arbitrary files, or execute arbitrary script code in the browser of an unsuspecting user and steal cookie-based authentication credentials. Other attacks are possible.
Redaxo 4.5 is vulnerable; other versions may also be affected.
Redaxo is prone to the following remote security vulnerabilities:
1. A local file-include vulnerability
2. Multiple arbitrary code-execution vulnerabilities
3. Multiple cross-site scripting vulnerabilities
4. An arbitrary file-upload vulnerability
Attackers can exploit these issues to execute arbitrary code, upload arbitrary files, or execute arbitrary script code in the browser of an unsuspecting user and steal cookie-based authentication credentials. Other attacks are possible.
Redaxo 4.5 is vulnerable; other versions may also be affected.
Exploit / POC
Redaxo Multiple Security Vulnerabilities
Attackers can exploit some of these issues through browser or using readily available tools.
Attackers can exploit some of these issues through browser or using readily available tools.