PHPWind Cross Site Scripting and Open Redirection Vulnerabilities
BID:74804
Info
PHPWind Cross Site Scripting and Open Redirection Vulnerabilities
| Bugtraq ID: | 74804 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-4135 CVE-2015-4134 |
| Remote: | Yes |
| Local: | No |
| Published: | May 24 2015 12:00AM |
| Updated: | Jul 15 2015 12:18AM |
| Credit: | Jing Wang |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
PHPWind Cross Site Scripting and Open Redirection Vulnerabilities
PHPWind is prone to a cross-site scripting vulnerability and an open-redirection vulnerability.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, this may allow the attacker to steal cookie-based authentication credentials and to launch other attacks or by constructing a crafted URI and enticing a user to follow it and when an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site.
PHPWind is prone to a cross-site scripting vulnerability and an open-redirection vulnerability.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, this may allow the attacker to steal cookie-based authentication credentials and to launch other attacks or by constructing a crafted URI and enticing a user to follow it and when an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site.
Exploit / POC
PHPWind Cross Site Scripting and Open Redirection Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
PHPWind Cross Site Scripting and Open Redirection Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
PHPWind Cross Site Scripting and Open Redirection Vulnerabilities
References:
References:
- PHPWind Home Page (PHPWind)