Serenity Client Management Portal Arbitrary File Upload and Multiple HTML Injection Vulnerabilities

Bugtraq ID:	71274
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 10 2014 12:00AM
Updated:	Nov 10 2014 12:00AM
Credit:	Halil Dalabasmaz
Vulnerable:	codecanyon Serenity Client Management Portal 1.0.1
Not Vulnerable:

Serenity Client Management Portal Arbitrary File Upload and Multiple HTML Injection Vulnerabilities

Serenity Client Management Portal is prone to an arbitrary file-upload vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could exploit these issues to execute arbitrary script code in a user's browser in the context of the affected site or to execute arbitrary code on the server.

Serenity Client Management Portal 1.0.1 is vulnerable; other versions may also be affected.

Serenity Client Management Portal Arbitrary File Upload and Multiple HTML Injection Vulnerabilities

An attacker can exploit these issues through a browser.

Serenity Client Management Portal Arbitrary File Upload and Multiple HTML Injection Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Serenity Client Management Portal Arbitrary File Upload and Multiple HTML Injection Vulnerabilities

References:

• Serenity Client Management Portal Homepage (Codecanyon)