OctavoCMS Cross Site Scripting
🗓️ 09 Jul 2014 00:00:00Reported by Andrew AntonioType 
packetstorm🔗 packetstormsecurity.com👁 40 Views
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2014-4331 | 19 Jul 201420:00 | – | cve |
 | CVE-2014-4331 | 19 Jul 201420:00 | – | cvelist |
 | EUVD-2014-4258 | 7 Oct 202500:30 | – | euvd |
 | CVE-2014-4331 | 19 Jul 201420:55 | – | nvd |
 | OctavoCMS <= 3.1.1 XSS Vulnerability - Active Check | 30 Jul 201400:00 | – | openvas |
 | Cross site scripting | 19 Jul 201420:55 | – | prion |
 | PT-2014-5815 | 19 Jul 201400:00 | – | ptsecurity |
 | CVE-2014-4331: Improper Neutralization of Input During Web Page Generation | 19 Jul 201400:00 | – | rapid7 |
 | CVE-2014-4331 OctavoCMS reflected XSS vulnerability | 16 Oct 201400:00 | – | securityvulns |
| Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl) | 17 Oct 201400:00 | – | securityvulns |
`This proprietary content management software is vulnerable to reflected XSS on the file admin/viewer.php, src parameter.
Current release on their demo site is vulnerable, same as other few sites I could find.
PoC: http://demo.octavocms.com/admin/viewer.php?src=%22%3E%3C/img%3E%3Ch2%3EThis%20is%20a%20test%3C/h2%3E%3Cscript%3Ealert(123)%3C/script%3E%3C!--%22
On the 9th of June I contacted the guys of OctavoCMS and eMB Group but they have not replied yet. At the moment of this writing the on-line demo still vulnerable.
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
09 Jul 2014 00:00Current
0.4Low risk
Vulners AI Score0.4
EPSS0.01854