Sql injection

SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php...

CVE-2015-1372

SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php...

CVE-2015-1371

Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/...

CVE-2015-1371

FerretCMS 1.0.4-alpha contains an Unrestricted file upload vulnerability that allows remote administrators to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct request to the file under custom/uploads/. The reports indicate the vulnerabilit...

CVE-2015-1373

The CVE-2015-1373 entry concerns ferretCMS 1.0.4-alpha, where multiple XSS vulnerabilities exist in admin.php. The attacker can inject arbitrary script/HTML through: (1) the action parameter in a search request, (2) the username in a login request that is not properly handled when logging the eve...

CVE-2015-1372

CVE-2015-1372 affects ferretCMS 1.0.4-alpha. The vulnerability is a SQL injection in the update action of admin.php via the p parameter, allowing remote attackers to execute arbitrary SQL commands. Impact is described as enabling data access/ modification with partial confidentiality, integrity, ...

CVE-2015-1374: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct 1 cross-site scripting XSS, 2 SQL injection, or 3 unrestricted file upload attacks...

PT-2015-5246

Name of the Vulnerable Software and Affected Versions ferretCMS version 1.0.4-alpha Description The issue allows remote administrators to execute arbitrary code by uploading a file with an executable extension to the custom/uploads/ directory, and then accessing it via a direct request. This is d...

PT-2015-5249

Name of the Vulnerable Software and Affected Versions ferretCMS version 1.0.4-alpha Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the admin.php file. These vulnerabilities allow remote attackers to hijack the authentication of administrators, potential...

PT-2015-5248

Name of the Vulnerable Software and Affected Versions ferretCMS version 1.0.4-alpha Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters. The affected parameter...

PT-2015-5247

Name of the Vulnerable Software and Affected Versions ferretCMS version 1.0.4-alpha Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the p parameter in an update action to the "admin.php" endpoint. Recommendations For...

CVE-2015-1371: Improper Input Validation

Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/...

CVE-2015-1372: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php...

CVE-2015-1373: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter in a search request, 2 username in a login request, which is not properly handled when logging the event, or 3 page titl...

ferretCMS 1.0.4-alpha - Multiple Vulnerabilities

ferretCMS 1.0.4-alpha - Multiple Vulnerabilities Advisory: Advisory ID: SROEADV-2015-10 Author: Steffen Rösemann Affected Software: ferretCMS v. 1.0.4-alpha Vendor URL: https://github.com/JRogaishio/ferretCMS Vendor Status: vendor will patch eventually CVE-ID: - Tested on: - Firefox 35, Iceweasel...

Multiple SQL Injection Vulnerabilities in FerretCMS

FerretCMS is a content management system. Multiple SQL injection vulnerabilities exist in FerretCMS, allowing attackers to exploit the vulnerabilities to compromise the application, access or modify data, or exploit potential vulnerabilities in the underlying database...

ferretCMS 1.0.4-alpha - Multiple Vulnerabilities

Advisory: Advisory ID: SROEADV-2015-10 Author: Steffen Rösemann Affected Software: ferretCMS v. 1.0.4-alpha Vendor URL: https://github.com/JRogaishio/ferretCMS Vendor Status: vendor will patch eventually CVE-ID: - Tested on: - Firefox 35, Iceweasel 31 - Mac OS X 10.10, Kali Linux 1.0.9a...

ferretCMS 1.0.4-alpha Cross Site Scripting / SQL Injection Vulnerabilities

ferretCMS version 1.0.4-alpha suffers from cross site scripting and remote SQL injection vulnerabilities. Author: Steffen Rösemann Affected Software: ferretCMS v. 1.0.4-alpha Vendor URL: https://github.com/JRogaishio/ferretCMS Vendor Status: vendor will patch eventually CVE-ID: - Tested on: -...