Exponent CMS 2.3.5 Cross Site Scripting

`CVE-2015-8667 - Exponent CMS 2.3.5 Multiple Cross Site Scripting  
Vulnerabilities  
  
  
Product : Exponent CMS  
  
CVE : CVE-2015-8667  
  
Author : Sachin Wagh  
  
Affected Version : Exponent CMS 2.3.5  
  
Fixed Version: Exponent CMS 2.3.7  
  
============================================================================  
Details:  
  
The Exponent CMS is prone to a multiple cross-site scripting  
vulnerabilities  
because it fails to sufficiently sanitize user-supplied input submitted to  
‘Username/Email’ field of ‘Reset Your Password’ module.  
  
An attacker may leverage this issue to execute arbitrary script code in the  
browser of an unsuspecting user in the context of the affected site. This  
may allow the attacker to steal cookie-based authentication credentials and  
to launch other attacks.  
  
============================================================================  
  
Affected Area(s):  
  
1.http://localhost/exponent-2.3.5/navigation/edit_contentpage/id/1  
  
Parameter:  
  
sef_name  
canonical  
page_title  
  
2.http://localhost/exponent-2.3.5/users/edituser/id/1  
  
Parameter:  
  
firstname  
  
3.http://localhost/exponent-2.3.5/users/manage_groups  
  
Parameter:  
  
name  
description  
  
============================================================================  
  
Credits & Authors :  
  
  
Sachin Wagh (@tiger_tigerboy)  
`