Flatnux CVE-2012-4892 Cross-Site Scripting Vulnerability
BID:73533
Info
Flatnux CVE-2012-4892 Cross-Site Scripting Vulnerability
| Bugtraq ID: | 73533 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-4892 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 10 2012 12:00AM |
| Updated: | Sep 10 2012 12:00AM |
| Credit: | Unknown |
| Vulnerable: |
Flatnux Flatnux 2012-03.08 Flatnux Flatnux 2011-08-09-2 Flatnux Flatnux 2009-02-04 Flatnux Flatnux 2009-01-27 Flatnux Flatnux 2008-12-11 |
| Not Vulnerable: | |
Discussion
Flatnux CVE-2012-4892 Cross-Site Scripting Vulnerability
Flatnux is prone to a cross-site scripting vulnerability. Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS 2012-03.08 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title_en, (2) summary_en, or (3) body_en parameter in a submitnews action to the news module, a different vulnerability than CVE-2012-4890. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Flatnux is prone to a cross-site scripting vulnerability. Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS 2012-03.08 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title_en, (2) summary_en, or (3) body_en parameter in a submitnews action to the news module, a different vulnerability than CVE-2012-4890. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploit / POC
Flatnux CVE-2012-4892 Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
Flatnux CVE-2012-4892 Cross-Site Scripting Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]