CVE-2012-1207

Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. dot dot in the module parameter to frontend/js.php...

CVE-2012-1209

CVE-2012-1209 describes a cross-site scripting (XSS) vulnerability in Fork CMS. The issue is in the backend/core/engine/base.php file for Fork CMS versions around 3.2.4 and possibly earlier than 3.2.5, where an attacker could inject arbitrary web script or HTML via the highlight parameter. The vu...

CVE-2012-1208

Fork CMS 3.2.4 (and possibly earlier versions) is affected by multiple XSS vulnerabilities in backend/core/engine/base.php that allow remote attackers to inject arbitrary script via the blog/settings report parameter or users/index error parameter. The issue is addressed in Fork CMS 3.2.5 (per li...

CVE-2012-1207

Summary (CVE-2012-1207) : Fork CMS vulnerable component is in frontend/core/engine/javascript.php ; a directory traversal flaw allows remote attackers to read files via a “..” in the module parameter to frontend/js.php . Affected: Fork CMS 3.2.4 and possibly earlier versions before 3.2.5. Impact ...

PT-2012-3130

Name of the Vulnerable Software and Affected Versions Fork CMS versions 3.2.4 and earlier Description A directory traversal issue allows remote attackers to read arbitrary files via a .. dot dot in the module parameter to "frontend/js.php". This could potentially expose sensitive information...

CVE-2012-1209: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter...

CVE-2012-1208: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the 1 report parameter to blog/settings or 2 error parameter to users/index...

CVE-2012-1207: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. dot dot in the module parameter to frontend/js.php...

PT-2012-3132

Name of the Vulnerable Software and Affected Versions Fork CMS versions 3.2.4 through 3.2.4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the highlight parameter in the backend/core/engine/base.php file. This could potentially lead...

PT-2012-3131

Name of the Vulnerable Software and Affected Versions Fork CMS versions prior to 3.2.5 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the report parameter to "blog/settings" or the error parameter to "users/index". Recommendations Fo...

Fork CMS v. 3. 2. 4 multiple defects ( LFI - XSS )-a vulnerability warning-the black bar safety net

Title: Fork CMS v. 3. 2. 4 - Multiple Vulnerabilities Developers: http://www.fork-cms.com Author: RandomStorm - http://www.randomstorm.com Avram Marius Gabriel d3v1l Test platform: Windows XP & Vista The management panel of the reflection type cross-siteXSS Test: http://www.badguest.cn...

Multiple XSS in Fork CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Fork CMS, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Fork CMS: CVE-2012-1188 1.1 Input passed via the "type" and "querystring" GET parameters to...

Fork CMS v.3.2.4 - Multiple Vulnerabilities ( LFI - XSS )

Exploit for php platform in category web applications Exploit Title: Fork CMS v.3.2.4 - Multiple Vulnerabilities Script Page : http://www.fork-cms.com Date: 11-02-2012 Author : RandomStorm - http://www.randomstorm.com Avram Marius Gabriel d3v1l Tested on: Windows XP & Vista Reflected Cross-Site...

Fork CMS 3.2.4 Cross Site Scripting / Local File Inclusion

Exploit Title: Fork CMS v.3.2.4 - Multiple Vulnerabilities Script Page : http://www.fork-cms.com Date: 11-02-2012 Author : RandomStorm - http://www.randomstorm.com Avram Marius Gabriel d3v1l Tested on: Windows XP & Vista Reflected Cross-Site Scripting XSS on Admin Panel POC:...

Fork CMS 3.2.4 - Local File Inclusion Cross-Site Scripting

Fork CMS 3.2.4 - Local File Inclusion Cross-Site Scripting Exploit Title: Fork CMS v.3.2.4 - Multiple Vulnerabilities Script Page : http://www.fork-cms.com Date: 11-02-2012 Author : RandomStorm - http://www.randomstorm.com Avram Marius Gabriel d3v1l Tested on: Windows XP & Vista Reflected...

Fork CMS 3.2.4 - Local File Inclusion / Cross-Site Scripting

Exploit Title: Fork CMS v.3.2.4 - Multiple Vulnerabilities Script Page : http://www.fork-cms.com Date: 11-02-2012 Author : RandomStorm - http://www.randomstorm.com Avram Marius Gabriel d3v1l Tested on: Windows XP & Vista Reflected Cross-Site Scripting XSS on Admin Panel POC:...

Fork CMS 3.1.5 - Multiple Cross-Site Scripting Vulnerabilities

Fork CMS 3.1.5 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/51045/info Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An...

Fork CMS 3.1.5 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/51045/info Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrary script cod...

Unix Command Shell, Bind TCP (via perl) IPv6

Listen for a connection and spawn a command shell via perl This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 152 include Msf::Payload::Single include Msf::Sessions::CommandShellOptio...

Fork CMS 3.1.5 Cross Site Scripting

Exploit Title: Fork CMS v.3.1.5 - Reflected Cross-Site Scripting XSS Vulnerability Script Page : http://www.fork-cms.com/ Date: 13-12-2011 Author : RandomStorm - http://www.randomstorm.com Avram Marius Gabriel d3v1l Tested on: Windows XP & Vista IE9 Cross-Site Scripting XSS on Front Site POC:...