Bitrix Site Manager 12.5.13 Insufficient Verification

Advisory ID: HTB23183 Product: Bitrix Site Manager Vendor: Bitrix, Inc Vulnerable Versions: 12.5.13 and probably prior Tested Version: 12.5.13 Advisory Publication: November 6, 2013 without technical details Vendor Notification: November 6, 2013 Vendor Patch: November 12, 2013 Public Disclosure:...

Bitrix Site Manager用户身份欺骗漏洞

CVECAN ID: CVE-2013-6788 Bitrix Site Manager是一款web站点管理工具。 Bitrix Site Manager中的预购电子存储模块显示时，没能充分核查数据的真实性，远程未经认证的用户可以更改“BITRIXSMSALEUID”的cookie，浏览其他用户的购物信息和执行某些操作，如添加或删除购物车中的物品。 0 Bitrix Site Manager=12.5.13 厂商补丁： Bitrix ----- 升级"sale"模块到14.0.1版本，请到厂商的主页下载：...

User Identity Spoofing in Bitrix Site Manager

High-Tech Bridge Security Research Lab discovered vulnerability in Bitrix Site Manager, which can be exploited to spoof user's identity and read, modify or delete pre-ordered items in customer's basket. 1 User Identity Spoofing in Bitrix Site Manager: CVE-2013-6788 The vulnerability exists due to...

PT-2013-64

Name of the Vulnerable Software and Affected Versions 1С-Битрикс: Управление сайтом affected versions not specified Description The issue is related to errors in the script integrity control mechanism, allowing an attacker to fake the integrity check and modify files in the system, bypassing acce...

Content Spoofing and Cross-Site Scripting vulnerabilities in Bitrix Site Manager

Hello 3APA3A! I want to warn you about security vulnerabilities in Bitrix Site Manager. It is commercial CMS. These are Content Spoofing and Cross-Site Scripting vulnerabilities. These holes bypass built-in WAF and all other protections of Bitrix. ------------------------- Affected products:...

Bitrix Site Manager 11.5 XSS / Content Spoofing

Hello list! I want to warn you about security vulnerabilities in Bitrix Site Manager. It is commercial CMS. These are Content Spoofing and Cross-Site Scripting vulnerabilities. These holes bypass built-in WAF and all other protections of Bitrix. ------------------------- Affected products:...

Bitrix Site Manager 11.5 XSS / Content Spoofing

Vulnerable are Bitrix Site Manager 11.5 and previous versions. Which consist JW Player Pro. Versions of Bitrix 11.5 after 2012.08.24 must be not affected, because the developers fixed these holes after my informing. As I've checked at main sites of developers, where I found these vulnerabilities,...

Bitrix Cross Site Scripting

Exploit Title: Bitrix Cross Site Scripting Date: 3.08.2011 Author: Sony Software Link: http://www.1c-bitrix.ru/ POC: http://st2tea.blogspot.com/2011/09/bitrix-cross-site-scripting.html .................................................................. templates:gameshowroom Demo:...

Bitrix Site Manager Remote File Inclusion

Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just write this exploit under perl module...

Bitrix Site Manager Multiple Remote File Include Vulnerability

No description provided by source. + Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just...

[ONSEC-09-014] 1C Bitrix WAF multiple XSS

Цель: 1C Bitrix WAF =8.0.5 Тип: Межсайтовый скриптинг Угроза: Средняя Дата обнаружения: 29.08.2009 Дата оповещения разработчика: 29.08.2009 Дата выхода исправления: 01.09.2009 Автор: Vladimir Vorontsov OnSec Russian Security Group onsec dot ru Описание: Проактивный фильтр WAF системы управления...

[ONSEC-09-013] 1C Bitrix 8.0.5 Admin Console XSS

ONSEC-09-013 1C Bitrix 8.0.5 Admin Console XSS Цель: 1C Bitrix 8.0.5 Тип: Межсайтовый скриптинг Угроза: Средняя Дата обнаружения: 25.08.2009 Дата оповещения разработчика: 30.08.2009 Дата выхода исправления: 01.09.2009 Автор: Vladimir Vorontsov OnSec Russian Security Group onsec dot ru Описание:...

Bitrix Site Manager 67 - Multiple Input Validation Vulnerabilities

Bitrix Site Manager 67 - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/33689/info Bitrix Site Manager is prone to multiple input-validation vulnerabilities: - An authentication-bypass vulnerability - A cross-site scripting vulnerability An attacker may levera...

Bitrix Site Manager 6/7 - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/33689/info Bitrix Site Manager is prone to multiple input-validation vulnerabilities: - An authentication-bypass vulnerability - A cross-site scripting vulnerability An attacker may leverage these issues to gain unauthorized access to the affected...

Open redirect

Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter...

CVE-2008-2052

Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter...

CVE-2008-2052

Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter...

CVE-2008-2052

Bitrix Site Manager 6.5 is vulnerable to an open redirect vulnerability located in the redirect.php file. This flaw allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the goto parameter, which can be leveraged to conduct phishing and other social engineering...

CVE-2008-2052: URL Redirection to Untrusted Site

Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter...

PT-2008-3569 · Bitrix +1 · Bitrix Site Manager +1

Name of the Vulnerable Software and Affected Versions: Bitrix Site Manager version 6.5 Description: The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter in the redirect.php file. This can lead to unauthorized acces...