Design/Logic Flaw

2018-02-2721:29:00

PRIOn knowledge base

www.prio-n.com

4.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.0%

lyadmin 1.x has XSS via the config[WEB_SITE_TITLE] parameter to the /admin.php?s=/admin/config/groupsave.html URI.

CPENameOperatorVersion
lyadminge1.0.0
lyadminle1.2.0

CPE	Name	Operator	Version
	lyadmin	ge	1.0.0
	lyadmin	le	1.2.0

References

github.com/imsebao/404team/blob/master/lyadmin/lyadmin.md