CVE-2019-18219

CVE-2019-18219 affects Sitemagic CMS 4.4.1. The vulnerability is a Cross-Site Scripting (XSS) flaw arising from inadequate input validation in the affected components, specifically index.php and upgrade.php. An attacker could inject JavaScript via crafted URLs (GET) or through the UpgradeMode POS...

CVE-2019-18219

Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting XSS vulnerability, as it fails to validate user input. The affected components index.php, upgrade.php allow for JavaScript injection within both GET or POST requests, via a crafted URL or via the UpgradeMode POST parameter...

Sitemagic CMS Cross-Site Scripting Vulnerability

Sitemagic CMS is a scalable content management system CMS. A cross-site scripting vulnerability exists in the SMFiles/FrmUpload.class.php file in Sitemagic CMS v4.4, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'filename' parameter...

CVE-2019-10238

Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...

CVE-2019-10238

Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...

Design/Logic Flaw

Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...

CVE-2019-10238

Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...

CVE-2019-10238

CVE-2019-10238 concerns Sitemagic CMS v4.4, where an XSS flaw exists in SMFiles/FrmUpload.class.php through the filename parameter. The vulnerability description across connected sources consistently identifies a cross-site scripting issue exploitable via the filename field in FrmUpload.class.php...

CVE-2019-9042

An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The...

Security feature bypass

DISPUTED An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts...

CVE-2019-9042

An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The...

CVE-2019-9042

Sitemagic CMS v4.4 contains a vulnerability in the index.php?SMExt=SMFiles URI that allows uploading a .php file and potentially executing arbitrary code (illustrated by 404.php) when FileExtensionFilter is not configured and there are untrusted user accounts. The issue has been described across ...

CVE-2019-9042

An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The...

CVE-2019-9042

An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The...

PT-2019-19331 · Sitemagic · Sitemagic Cms

Name of the Vulnerable Software and Affected Versions: Sitemagic CMS version 4.4 Description: An issue in the index.php?SMExt=SMFiles URI allows users to upload .php files, potentially executing arbitrary code, as shown with 404.php. This issue can only occur if the administrator fails to set the...

Sitemagic CMS 4.1 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Sitemagic CMS 4.1 Product: Fixed in: 4.1.1 Fixed Version http://sitemagic.org/index.php?SMExt=SMDownloads& Link: SMDownloadsFile=SitemagicCMS411.zip Vendor Contact: [email protected] Vulnerability XSS Type: Remote Yes Exploitable:...

Sitemagic CMS 'SMTpl' Parameter Directory Traversal Vulnerability

This host is running Sitemagic CMS and is prone to directory traversal vulnerability. OpenVAS Vulnerability Test $Id: secpodsitemagiccmsdirtraversalvuln.nasl 7577 2017-10-26 10:41:56Z cfischer $ Sitemagic CMS 'SMTpl' Parameter Directory Traversal Vulnerability Authors: Antu Sanadi Copyright:...

Sitemagic CMS 'SMTpl' Parameter Directory Traversal Vulnerability

Sitemagic CMS is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Sitemagic CMS Directory Traversal

Vendor: Sitemagic CMS Product web page: http://www.sitemagic.org Autore : Andrea Bocchetti Twitter: @AndreaBocchetti Desc: Sitemagic CMS suffers from a directory traversal "SMTpl" Url : http://codemagic.dk/smcmsdemoint/index.php?SMTpl=../../../../../../../../../../etc/passwd%00.png...

Sitemagic CMS - 'SMTpl' Directory Traversal

source: https://www.securityfocus.com/bid/48399/info Sitemagic CMS is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain arbitrary local files in the context of the webserver process...