CVE-2017-6069

Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter...

CVE-2017-6069

Subrion CMS 4.0.5 is affected by CVE-2017-6069: CSRF in admin/blog/add/ can let an attacker add arbitrary tags and may allow XSS via the tags parameter. Connected records also describe a separate XSS vulnerability (via the blog/add/ body) that is a different issue from CVE-2017-6069. The CVE desc...

CVE-2017-6068

Subrion CMS 4.0.5 is affected by a CSRF flaw in admin/blocks/add/ that allows an attacker to create blocks and potentially inject XSS through the content parameter. The root cause is a CSRF vulnerability in the block-creation endpoint; exploitation details and whether an in-the-wild exploit exist...

CVE-2017-6066

Subrion CMS 4.0.5 has a CSRF vulnerability in the admin/languages/edit/1/ endpoint. An attacker can perform any Edit Language action and may inject XSS via the title parameter. This issue is consistently described across multiple sources (NVD/CNVD/OSV) with the same details. No remediation steps ...

CVE-2017-6013

Subrion CMS 4.0.5.10 is affected by an SQL injection in the admin/database/ URI via the query parameter. The vulnerability enables arbitrary SQL execution (impact: confidentiality, integrity, and availability can be affected). Documented in NVD/CNVD entries for CVE-2017-6013; no patch/version rem...

CVE-2017-6002

Subrion CMS 4.0.5.10 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in admin/blog/add/. An attacker can exploit CSRF to add arbitrary blog entries and may inject XSS into the created entry via the body parameter. The vulnerability is documented in multiple sources (e.g., CNVD-20...

CVE-2017-6002

Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attacker can add any blog entry, and can optionally insert XSS into that entry via the body parameter...

Subrion CMS PHP Object Injection Vulnerability

Subrion CMS is an open source content management system CMS. Subrion CMS suffers from a PHP object injection vulnerability that stems from a failure to adequately validate user input. An attacker can use this vulnerability to inject arbitrary objects into the application, delete files, view files...

CVE-2017-5543

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

Design/Logic Flaw

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

CVE-2017-5543

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

CVE-2017-5543

CVE-2017-5543 affects Subrion CMS 4.0.5 where a vulnerable PHP file, includes/classes/ia.core.users.php, allows remote attackers to perform PHP Object Injection via crafted serialized data in a salt cookie during login. Public references and CVSS indicate a high-severity impact (NVD lists base sc...

CVE-2017-5543

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2016-10246)

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A cross-site scripting vulnerability exists in Subrion CMS version 4.0.5, which stems from the failure of...

Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass Persistent Cross-Site Scripting

Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass Persistent Cross-Site Scripting Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin Date: 15-10-2016 Software Link: http://www.subrion.org/download/ Vendor: http://www.subrion.org Google Dork: "Powered by Subrion CMS...

Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass / Persistent Cross-Site Scripting

Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin Date: 15-10-2016 Software Link: http://www.subrion.org/download/ Vendor: http://www.subrion.org Google Dork: "Powered by Subrion CMS" Exploit Author: Ahsan Tahir Contact: https://twitter.com/AhsanTahirAT |...

Subrion CMS 4.0.5 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin Date: 15-10-2016 Software Link: http://www.subrion.org/download/ Vendor: http://www.subrion.org Google Dork: "Powered by Subrion CMS" Exploit Author: Ahsan Tahir Contact: https://twitter.com/AhsanTahirAT |...

Subrion CMS 'front/actions.php' Arbitrary File Deletion Vulnerability

Subrion CMS is a PHP-based content management system. An arbitrary file deletion vulnerability exists in Subrion CMS 'front/actions.php'. An attacker can exploit the vulnerability to delete arbitrary files...

subrion backend sql any implementation

No description provided by source...

Subrion CMS 4.0.5 - SQL Injection

Exploit for php platform in category web applications Document Title: =============== Subrion v4.0.5 CMS - SQL Injection Vulnerability Product & Service Introduction: =============================== Subrion is a full featured open source CMS written in PHP 5 & MySQL with many options. Here is the...