Gecko CMS Multiple Input Validation Vulnerabilities

Bugtraq ID:	72085
Class:	Input Validation Error
CVE:	CVE-2015-1422 CVE-2015-1423 CVE-2015-1425 CVE-2015-1424
Remote:	Yes
Local:	No
Published:	Jan 12 2015 12:00AM
Updated:	May 07 2015 05:26PM
Credit:	Gjoko Krstic
Vulnerable:	JAKWEB Gecko CMS 2.3 JAKWEB Gecko CMS 2.2
Not Vulnerable:

Gecko CMS Multiple Input Validation Vulnerabilities

Gecko CMS is prone to a cross-site request forgery vulnerability, multiple SQL-injection vulnerabilities, multiple cross-site scripting vulnerabilities and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to perform certain unauthorized administrative actions, execute HTML and script code, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Gecko CMS 2.2 and 2.3 are vulnerable; other versions may also be affected.

Gecko CMS Multiple Input Validation Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Gecko CMS Multiple Input Validation Vulnerabilities

References:

• Gecko CMS 2.3 Multiple Vulnerabilities (Gjoko Krstic)
  
• Gecko CMS Homepage (JAKWEB)