XSS in Saurus CMS

Vulnerability ID: HTB22361 Reference: http://www.htbridge.ch/advisory/xssinsauruscms.html Product: Saurus CMS Community Editon Vendor: Saurused Ltd Vulnerable Version: 4.7.0 Vendor Notification: 27 April 2010 Vulnerability Type: XSS Cross Site Scripting Status: Not Fixed, Vendor Alerted, Awaiting...

Cross-site Scripting (XSS) in Saurus CMS

High-Tech Bridge SA Security Research Lab has discovered a vulnerability in Saurus CMS which could be exploited to perform cross-site scripting XSS attacks. 1 Cross-site scripting vulnerability in Saurus CMS: CVE-2010-1997 The vulnerability exists due to insufficient input sanitation in the HTTP...

Saurus CMS 4.6.4 - Multiple Remote File Inclusions

Exploit Title: SaurusCMS = 4.6.4 Multiple RFI Exploit Date: 19-12-2009 Author: cr4wl3r Software Link: http://www.saurus.info Version: N/A Tested on: GNU/LINUX Code class.writeexcelworkbook.inc.php global $classpath; requireonce $classpath."excel/class.writeexcelbiffwriter.inc.php"; requireonce...

Saurus CMS 4.6.4 - Multiple Remote File Inclusions

Saurus CMS 4.6.4 - Multiple Remote File Inclusions Exploit Title: SaurusCMS = 4.6.4 Multiple RFI Exploit Date: 19-12-2009 Author: cr4wl3r Software Link: http://www.saurus.info Version: N/A Tested on: GNU/LINUX Code class.writeexcelworkbook.inc.php global $classpath; requireonce...