GetSimple CMS CVE-2013-7243 Cross-Site Scripting Vulnerability

Bugtraq ID:	73537
Class:	Input Validation Error
CVE:	CVE-2013-7243
Remote:	Yes
Local:	No
Published:	Jan 17 2014 12:00AM
Updated:	Jan 17 2014 12:00AM
Credit:	Unknown
Vulnerable:	Cagintranetworks Getsimple Cms 3.2.3 Cagintranetworks GetSimple CMS 3.1.2
Not Vulnerable:

GetSimple CMS CVE-2013-7243 Cross-Site Scripting Vulnerability

GetSimple CMS is prone to a cross-site scripting vulnerability. Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1.2 and 3.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) post-menu field to edit.php or (2) Display name field to settings.php. NOTE: The Custom Permalink Structure and Email Address fields are already covered by CVE-2012-6621.

GetSimple CMS CVE-2013-7243 Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

GetSimple CMS CVE-2013-7243 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

GetSimple CMS CVE-2013-7243 Cross-Site Scripting Vulnerability

References:

• http://packetstormsecurity.com/files/124711 (MISC)
  
• IBM X-Force Exchange Beta (XF)