Fiyo CMS Multiple Security Vulnerabilities
BID:73437
Info
Fiyo CMS Multiple Security Vulnerabilities
| Bugtraq ID: | 73437 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-9145 CVE-2014-9146 CVE-2014-9147 CVE-2014-9148 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 30 2015 12:00AM |
| Updated: | Mar 30 2015 12:00AM |
| Credit: | Mahendra |
| Vulnerable: |
Fiyo Fiyo Cms 2.0.1.8 |
| Not Vulnerable: | |
Discussion
Fiyo CMS Multiple Security Vulnerabilities
Fiyo CMS is prone to multiple SQL-injection vulnerabilities, a directory-traversal vulnerability, multiple SQL-injection vulnerabilities, an authentication-bypass vulnerability and an access-control bypass vulnerability.
An attacker can leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, write an arbitrary file within the context of the web server, or perform unauthorized actions. This may aid in launching further attacks.
Fiyo CMS is prone to multiple SQL-injection vulnerabilities, a directory-traversal vulnerability, multiple SQL-injection vulnerabilities, an authentication-bypass vulnerability and an access-control bypass vulnerability.
An attacker can leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, write an arbitrary file within the context of the web server, or perform unauthorized actions. This may aid in launching further attacks.
Exploit / POC
Fiyo CMS Multiple Security Vulnerabilities
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting user into following a malicious URI.
The following proof-of-concept is available:
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting user into following a malicious URI.
The following proof-of-concept is available:
Solution / Fix
Fiyo CMS Multiple Security Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].