CVE-2012-4771

Subrion CMS

CVE-2012-4773

Subrion CMS before 2.2.3 contains multiple vulnerabilities: CVE-2012-4771 (XSS), CVE-2012-4772 (SQLi), and CVE-2012-4773 (CSRF) that can enable an attacker to hijack administrator sessions, perform unauthorized actions (including creating an admin account via /admin/accounts/add/), and modify sen...

CVE-2012-4772

Subrion CMS prior to 2.2.3 contains a SQL Injection in the /register/ path (parameter plan_id) that allows remote attackers to alter SQL queries and potentially compromise the system. The vulnerability (CVE-2012-4772) is described in multiple sources as a classic injection through the plan_id fie...

CVE-2012-4773

Multiple cross-site request forgery CSRF vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding an administrator account via an add action to...

Multiple vulnerabilities in Subrion CMS

Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...

PT-2012-2189

Name of the Vulnerable Software and Affected Versions Subrion CMS version 2.0.4 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the user name or password field in the admin/index.php file. Recommendations For Subrion CMS version 2.0.4,...

CVE-2012-4773: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding an administrator account via an add action to...

subrion CMS 2.2.1 - Multiple Vulnerabilities

subrion CMS 2.2.1 - Multiple Vulnerabilities Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL...

CVE-2012-4771: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 admin/accounts/, 2 admin/manage/, or 3 admin/manage/blocks/edit/; or 4 group parameter to admin/configuration/. NOTE: The...

PT-2012-5977

Name of the Vulnerable Software and Affected Versions Subrion CMS version 2.2.1 Subrion CMS version 2.2.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including multi title in "/blocks/add/", cost, days, or titleen in "/plans/add/",...

CVE-2012-5452: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 multititle parameter to blocks/add/; 2 cost, 3 days, or 4 titleen parameter to plans/add/; 5 name or 6 titleen parameter to fields/group/add/ in...

PT-2012-5582

Name of the Vulnerable Software and Affected Versions Subrion CMS versions prior to 2.2.3 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the id parameter to API endpoints such as "/admin/accounts/", "/admin/manage/", or...

PT-2012-2188

Name of the Vulnerable Software and Affected Versions Subrion CMS version 2.0.4 Description A cross-site scripting XSS issue exists in the poll module, allowing remote attackers to inject arbitrary web script or HTML via the title field. Recommendations For Subrion CMS version 2.0.4, consider...

PT-2012-5584

Name of the Vulnerable Software and Affected Versions Subrion CMS versions prior to 2.2.3 Description The issue allows remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information. This can be demonstrated by adding an administrato...

CVE-2012-4772: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the planid parameter...

CVE-2011-5212: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the 1 user name or 2 password field...

PT-2012-5583

Name of the Vulnerable Software and Affected Versions Subrion CMS versions prior to 2.2.3 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the plan id parameter in the "register/" endpoint. Recommendations For versions prior to 2.2.3, update to...

CVE-2011-5211: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the poll module in Subrion CMS 2.0.4 allows remote attackers to inject arbitrary web script or HTML via the title field. NOTE: some of these details are obtained from third party information. NOTE: this might overlap CVE-2012-5452...

subrion CMS 2.2.1 - Multiple Vulnerabilities

Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...

Subrion CMS 2.2.1 XSS / CSRF / SQL Injection

Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...