Lunar CMS Cross Site Request Forgery and Multiple HTML Injection Vulnerabilities
BID:68153
Info
Lunar CMS Cross Site Request Forgery and Multiple HTML Injection Vulnerabilities
| Bugtraq ID: | 68153 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-4718 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 23 2014 12:00AM |
| Updated: | Mar 19 2015 09:22AM |
| Credit: | LiquidWorm |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Lunar CMS Cross Site Request Forgery and Multiple HTML Injection Vulnerabilities
Lunar CMS is prone to a cross-site request-forgery vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can leverage these issues to perform certain administrative actions, gain unauthorized access to the affected application, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.
Lunar CMS 3.3 is vulnerable; other versions may also be affected.
Lunar CMS is prone to a cross-site request-forgery vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can leverage these issues to perform certain administrative actions, gain unauthorized access to the affected application, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.
Lunar CMS 3.3 is vulnerable; other versions may also be affected.
Exploit / POC
Lunar CMS Cross Site Request Forgery and Multiple HTML Injection Vulnerabilities
An attacker can exploit HTML-injection issues through a browser. To exploit the cross-site request-forgery issue the attacker must entice an unsuspecting victim into viewing a malicious webpage.
An attacker can exploit HTML-injection issues through a browser. To exploit the cross-site request-forgery issue the attacker must entice an unsuspecting victim into viewing a malicious webpage.
Solution / Fix
Lunar CMS Cross Site Request Forgery and Multiple HTML Injection Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Lunar CMS Cross Site Request Forgery and Multiple HTML Injection Vulnerabilities
References:
References: