bloofoxCMS 0.5.2.1 - CSRF (Add user)

Title: bloofoxCMS 0.5.2.1 - CSRF Add user Exploit Author: LiPeiYi Date: 2020-12-18 Vendor Homepage: https://www.bloofox.com/ Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 Version: 0.5.1.0 -.5.2.1 Tested on: windows 10 Desc: The application interface allows users to...

BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting

Title: BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting Exploit Author: LiPeiYi Date: 2020-12-18 Vendor Homepage: https://www.bloofox.com/ Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 Version: 0.5.1.0 -.5.2.1 Tested on: windows 10 Vulnerable paper:...

BloofoxCMS 0.5.2.1 Cross Site Scripting

Title: BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting Exploit Author: LiPeiYi Date: 2020-12-18 Vendor Homepage: https://www.bloofox.com/ Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 Version: 0.5.1.0 -.5.2.1 Tested on: windows 10 Vulnerable paper:...

BloofoxCMS Directory Traversal Vulnerability

bloofoxCMS is a free open source PHP + MySQL based Web content management system . A directory traversal vulnerability exists in bloofoxCMS 0.5.2.1. An attacker can exploit this vulnerability by using the admin/index.php?mode=tools&page=upload URI to upload any .php file to . /media/images/...

CVE-2020-35709

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

CVE-2020-35709

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

Directory traversal

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

CVE-2020-35709

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

CVE-2020-35709

BloofoxCMS 0.5.2.1 is vulnerable to a directory traversal issue: admins can upload arbitrary .php files to ../media/images/ via admin/index.php?mode=tools&page=upload when uploading with Content-Type: application/octet-stream. This leads to uploading PHP payloads on the server; exact exploitation...

File Upload Vulnerability in bloofoxCMS v0.5.1

bloofoxCMS is an open source, easy to use small content management system. A file upload vulnerability exists in bloofoxCMS v0.5.1. An attacker can exploit this vulnerability to upload a malicious php file in the user's avatar upload area to gain control of the web server...

bloofoxCMS 0.5.0 Cross Site Scripting

Affected software: bloofox cms Type of vulnerability:xss URL:bloofox.com Discovered by: provensec Website: provensec.com version: 0.5.0 Proof of concept http://demo.bloofox.com/admin/index.php?mode=content&page=media&action=edit&file=%22%3E%3Cimg%20src=d%20onerror=confirm1;%3E&type=1%27...

BloofoxCMS Registration Plugin SQL Injection Vulnerability

No description provided by source. Vulnerability ID: HTB22658 Reference: http://www.htbridge.ch/advisory/sqlinjectioninbloofoxcmsregistrationplugin.html Product: BloofoxCMS Vendor: bloofox.com http://bloofox.com/ Vulnerable Version: 0.3.5 and probably prior versions Vendor Notification: 13 Octobe...

bloofoxCMS 0.3.5 'search' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/36700/info bloofoxCMS is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input passed through the 'search' parameter. An attacker may leverage this issue ...

bloofoxCMS 0.3 Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/27361/info bloofoxCMS is prone to a directory-traversal vulnerability, a SQL-injection vulnerability, and an authentication-bypass vulnerability. The SQL-injection vulnerability occurs because the application fails to...

BloofoxCMS 0.3.5 - Information Disclosure Vulnerabilities

No description provided by source. Vulnerability ID: HTB22660 Reference: http://www.htbridge.ch/advisory/informationdisclosureinbloofoxcms1.html Product: BloofoxCMS Vendor: bloofox.com http://bloofox.com/ Vulnerable Version: 0.3.5 and probably prior versions Vendor Notification: 13 October 2010...

BloofoxCMS 0.2.2 Img_Popup.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/23487/info BloofoxCMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

bloofoxCMS "fileurl"跨站脚本和跨站请求伪造漏洞

bloofox CMS是一款内容管理系统。 1由于通过"fileurl"参数传递到admin/index.php的输入当"mode"设置为"settings"，"page"设置为"editor"在返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 2应用程序允许用户通过未验证的HTTP请求执行某些操作，攻击者可以欺骗用户登录访问特制网页并添加新的项目。 0 bloofoxCMS 0.5 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.bloofox.com...

bloofoxCMS多个安全漏洞

Bugtraq ID:65019 bloofox CMS是一款内容管理系统。 bloofox CMS不正确过滤用户提交的输入，允许远程攻击者利用漏洞进行SQL注入，文件包含，跨站请求伪造攻击。 0 bloofox CMS 0.5.0 目前没有详细解决方案提供： http://www.bloofox.com/download.21.html EXPLOIT http://localhost/admin/index.php?mode=settings&page=editor&fileurl=config.php !/usr/bin/perl Title : bloofoxCMS V0.5.0...

BloofoxCMS 0.5.0 - Multiple Vulnerabilities

BloofoxCMS 0.5.0 - Multiple Vulnerabilities bloofoxCMS V0.5.0 - Multiple Vulnerabilties =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

bloofoxCMS 0.5.0 CSRF / LFI / SQL Injection

bloofoxCMS V0.5.0 - Multiple Vulnerabilties =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.bloofox.com/download.21.html 1...