CVE-2018-18200

Concretely, CVE-2018-18200 affects REDAXO (before 5.6.4) in the Benutzerverwaltung module, where a SQL injection vulnerability allows arbitrary SQL execution. Root cause details are not provided in the sources, but Red Hat/CNVD entries and the NVD note the same issue and point to REDAXO 5.6.4 as ...

CVE-2018-17830

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...

CVE-2018-17831

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...

CVE-2018-17831

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...

Sql injection

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...

Input validation

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...

CVE-2018-17830

The CVE-2018-17830 entry concerns REDAXO 5.6.2 where the $args variable in addons/mediapool/pages/index.php is not effectively filtered because parameter names are not restricted (only values). This allows an attacker to inject XSS payloads via the URL parameter like index.php?page=mediapool/medi...

CVE-2018-17830

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...

CVE-2018-17831

CVE-2018-17831 affects REDAXO prior to 5.6.3. The vulnerability is a SQL injection in the rex_list class caused by the prepareQuery function in core/lib/list.php, exploitable via index.php?page=users/users with the sort parameter. Impact concerns backend and also frontend when rex_list is used. T...

CVE-2018-17831

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...

REDAXO CMS Cross-Site Request Forgery Vulnerability

REDAXO CMS is an open source content management system CMS. The system supports custom modules , plug-in extensions , project backup and so on. A cross-site request forgery vulnerability exists in REDAXO CMS version 4.7.2. A remote attacker can add an administrator account with the help of...

CVE-2018-15850

An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user...

CVE-2018-15850

An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user...

Cross site request forgery (csrf)

An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user...

CVE-2018-15850

CVE-2018-15850 affects REDAXO CMS 4.7.2, where a CSRF flaw enables an attacker to add an administrator account via index.php?page=user. Public sources (NVD/NVD-derived entries and CNVD) describe a CSRF vulnerability in REDAXO CMS 4.7.2 with the described impact. CVSS data indicate a network-based...

CVE-2018-15850

An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user...

Redaxo CMS Mediapool Plugin File Upload Vulnerability

Redaxo CMS is an open source Web portal content management system CMS. The system supports custom modules , plug-in extensions , project backup and so on. Redaxo CMS Mediapool plugin file upload vulnerability , an attacker can exploit the vulnerability to upload arbitrary files...

Redaxo CMS Mediapool Addon < 5.5.1 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: Redaxo CMS Mediapool Addon 5.5.1 - Arbitrary File Upload Exploit Author: email protected Vendor Homepage: https://redaxo.org Software Link: https://redaxo.org/download/redaxo/5.5.1.zip Version: 5.5.1 and older Tested on: LinuxMi...

Redaxo CMS Mediapool Addon < 5.5.1 - Arbitrary File Upload

Exploit Title: Redaxo CMS Mediapool Addon 5.5.1 - Arbitrary File Upload Date: 2018-06-13 Exploit Author: mn@HackerWerkstatt Vendor Homepage: https://redaxo.org Software Link: https://redaxo.org/download/redaxo/5.5.1.zip Version: 5.5.1 and older Tested on: LinuxMint More: Login required PoC In the...

Redaxo CMS Mediapool Addon 5.5.1 - Arbitrary File Upload

Redaxo CMS Mediapool Addon 5.5.1 - Arbitrary File Upload Exploit Title: Redaxo CMS Mediapool Addon 5.5.1 - Arbitrary File Upload Date: 2018-06-13 Exploit Author: mn@HackerWerkstatt Vendor Homepage: https://redaxo.org Software Link: https://redaxo.org/download/redaxo/5.5.1.zip Version: 5.5.1 and...