CVE-2017-1000160

EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting that results in PHP code injection. Affected product/version is explicitly stated (ExpressionEngine 3.4.2). The impact is described as XSS leading to PHP code execution, with no explicit exploit details, vectors, or affected co...

CVE-2017-1000160

EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection...

CVE-2017-1000160: Improper Neutralization of Input During Web Page Generation

EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection...

ExpressionEngine: Potential code injection in fun delete_directory

Under /system/ee/legacy/libraries/Functions.php, function deletedirectory contains calls to exec 3 times using different, potentially "unsanitized" paramateres. As the PHP manual suggest, escapeshellarg should be used to sanitize individual arguments 1. On an implementation in which the attacker...

ExpressionEngine: Image lib - unescaped file path

Under ./system/ee/legacy/libraries/Imagelib.php There are function from CodeIgniter to manipulate images. The issue is that the PHP function exec is used two times in two different functions: imageprocessimagemagick and imageprocessnetpbm In both cases the fullsrcpath and fulldstpath are given...

EllisLab ExpressionEngine Weak Password Vulnerability

EllisLab ExpressionEngine is the United States EllisLab company's set of content management system CMS, it provides Web publishing, template engine and attachment components and other modules. A security vulnerability exists in EllisLab ExpressionEngine version 2.x prior to 2.11.8 and version 3.x...

CVE-2017-0897

ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...

Remote code execution

ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...

CVE-2017-0897

ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...

CVE-2017-0897

ExpressionEngine <= 2.x (prior to 2.11.8) and

CVE-2017-0897

ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...

CVE-2017-0897: Use of Insufficiently Random Values

ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...

ExpressionEngine: Remote Code Execution in the Import Channel function

Hello, Administrators are allow to import channels by visiting http://HOST/PATHTOEE/admin.php?/cp/channels/sets and uploading .zip archives that contain the information about the channels to be imported. The archives are then extracted into temporary directories, which are kept in the...

ExpressionEngine: Open redirects protection bypass

Hello, When a redirect is to be issue on an ExpressionEngine instance, a request to the following URL is made: http://HOST/PATHTOEE/index.php?URL=TARGETURL Where TARGETURL is replaced with the actual URL we desire to redirect to. The script PATHTOEEDIR/system/ee/legacy/libraries/Redirect.php is t...

ExpressionEngine: Type Juggling -> PHP Object Injection -> SQL Injection Chain

Justin Kennedy identified a Type Juggling vulnerability in ExpressionEngine that allowed access to unserialize using user supplied data, ultimately achieving SQL Injection. The full details of this vulnerability can be found here:...

ExpressionEngine: Reflective XSS

URL http://blackdoorsec.net/sandbox/express/admin.php?/cp/members/bans&search=&sortcol=me%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3Emberid&sortdir=desc URL Parameters /cp/members/bans search= sortcol=me%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3Emberid sortdir=desc The...

ExpressionEngine: Full path + some back-end code disclosure

Hello, Ironically enough, I just discovered a full path disclosure issue. When an admin edits their personal information, a request like the following gets sent: POST /ee/admin.php?/cp/members/profile/settings&id=1 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:45.0...

CVE-2014-5387

Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 columnfilter or 2 category parameter to system/index.php or the 3 tblsort0 parameter in the comment module to system/index.php...

Sql injection

Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 columnfilter or 2 category parameter to system/index.php or the 3 tblsort0 parameter in the comment module to system/index.php...

CVE-2014-5387

Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 columnfilter or 2 category parameter to system/index.php or the 3 tblsort0 parameter in the comment module to system/index.php...