Subrion Cross-Site Scripting Vulnerability

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A cross-site scripting vulnerability exists in Subrion CMS version 4.2.1, which stems from the program's...

CVE-2018-14835

CVE-2018-14835 affects Subrion CMS v4.2.1. The vulnerability is a Stored XSS caused by missing escaping/encoding in tooltip information displayed in multiple areas, enabling injected scripts to persist in affected pages. The connected documents corroborate this issue (NVD entry and various securi...

CVE-2018-14835

Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas...

CVE-2018-14836

Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it but not perform actions if the Guests user group has access to the Admin panel...

CVE-2018-14836

Subrion 4.2.1 is reported vulnerable to improper access control. The issue allows user groups that should not have Admin panel access to reach the Admin UI if the Guests group has access, though they cannot perform actions. Impact is limited to unauthorized visibility of Admin panel (per descript...

Subrion CMS 4.2.1 Cross Site Scripting

Exploit Title: Stored XSS at Subrion CMS 4.2.1 Date: 06.06.2018 Exploit Author: Ismail Tasdelen Vendor Homepage: https://intelliants.com/ Software : Subrion CMS Software Version : 4.2.1 Vulnerability : Stored XSS Open Redirect Payload : " Type: Webapps PoC Video :...

Arbitrary File Upload

Intelliants/subrion is vulnerable to arbitrary file upload. The application doesn't restrict the type of files which can be uploaded as a profile image. These files may be executed when the profile is rendered...

Subrion CMS Cross-Site Request Forgery Vulnerability

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a variety of extensions plug-ins and more. A cross-site request forgery vulnerability exists in Subrion CMS versions prior to 4.2.0 that stems from a...

CVE-2017-15063

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...

Cross site request forgery (csrf)

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...

CVE-2017-15063

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...

CVE-2017-15063

Subrion CMS CSRF vulnerability (CVE-2017-15063) affects Subrion CMS 4.1.x–4.1.5 and before 4.2.0 due to a logic error. Despite a CSRF-detection mechanism, the check is invoked too late in ia.core.php, enabling exploitation of query parameters to panel/database. The available sources confirm the a...

CVE-2017-15063

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...

Subrion CMS 4.1.5 Cross Site Scripting

| | Exploit Title: Subrion Cms Cross Site Scripting XSS | Exploit Author: Ashiyane Digital security Team | Vendor Homepage : https://subrion.org/ | Software Link: https://tools.subrion.org/get/latest.zip | Version: 4.1.5 | Date: 2017 - 07 - 9 | Tested on: Kali-Linux /FireFox | Exploit : System...

Subrion CMS 4.1.5 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications | Exploit Title: Subrion Cms Cross Site Scripting XSS | Exploit Author: Ashiyane Digital security Team | Vendor Homepage : https://subrion.org/ | Software Link: https://tools.subrion.org/get/latest.zip | Version: 4.1.5 | Date: 2017 - 07 - 9 |...

Cross-Site Request Forgery (CSRF)

intelliants/subrion is vulnerable to cross-site request forgery CSRF attacks. The library does not have the proper CSRF countermeasures in place, allowing a malicious user to delete an arbitrary blog post...

Remote Code Execution (RCE) Through Deserialization

Subrion CMS is vulnerable to remote code execution RCE. A malicious user can and execute arbitrary code by passing a string of a serialized object to the server through $COOKIE'salt' when submitting a login request. This causes the server to execute the unserialize function that will result in...

Subrion CMS SQL Injection Vulnerability (CNVD-2017-18104)

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A SQL injection vulnerability exists in the /front/actions.php file in Subrion CMS versions prior to 4.1.6...

Subrion CMS SQL Injection Vulnerability (CNVD-2017-18105)

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A SQL injection vulnerability exists in the /front/search.php file in Subrion CMS versions prior to...

SQL Injection

Subrion is vulnerable to SQL injection attacks. The library does not do any checking through the $POST array in the /front/actions.php file, allowing a malicious user to inject and execute arbitrary SQL...