Multiple vulnerabilities in Nucleus

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Full path disclosure, SQL DB Structure Extraction, SQL Injection, Cross-Site Scripting и Insufficient Anti-automation уязвимостях в Nucleus. Full path disclosure: http://site/action.php?action=addcomment SQL DB Structure Extraction:...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Nucleus: information leak, SQL injection, crossite scripting, automation protection bypass...

Nucleus cross-site scripting vulnerability

Overview Nucleus, an open source content management system, contains a cross-site scripting vulnerability. Impact An arbitrary script could be executed on the web browser of an administrator with Nucleus super-admin privilege. If session information from a cookie is leaked, an attacker could...

Cross site scripting

Cross-site scripting XSS vulnerability in action.php in Nucleus CMS 3.31 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO, which is not quoted when processing PHPSELF...

CVE-2008-0497

Cross-site scripting XSS vulnerability in action.php in Nucleus CMS 3.31 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO, which is not quoted when processing PHPSELF...

CVE-2008-0497

The CVE-2008-0497 entry concerns Nucleus CMS 3.31, where an XSS vulnerability exists in action.php. The underlying issue is that PATH_INFO is not quoted when PHP_SELF is processed, enabling remote attackers to inject arbitrary web script or HTML. The affected component is action.php within Nucleu...

CVE-2008-0497

Cross-site scripting XSS vulnerability in action.php in Nucleus CMS 3.31 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO, which is not quoted when processing PHPSELF...

DSECRG-08-006.txt

It is updated version of advisory. updated info in "Fix Information" part, mistake in vendor name. Digital Security Research Group DSecRG Advisory DSECRG-08-006 Application: Nucleus CMS Versions Affected: 3.31 Vendor URL: http://nucleuscms.org Bugs: XSS Injection in URL Exploits: YES Reported:...

Nucleus 3.31 XSS in path

Hello. Digital Security Research Group DSecRG Advisory DSECRG-08-006 Application: Nucleus CMS Versions Affected: 3.31 Vendor URL: http://nucleuscms.org Bugs: XSS Injestion in URL Exploits: YES Reported: 16.01.2008 Vendor response: 18.01.2008 Date of Public Advisory: 29.01.2008 Authors: Alexandr...

Nucleus CMS 3.22 - action.php Cross-Site Scripting

Nucleus CMS 3.22 - action.php Cross-Site Scripting source: https://www.securityfocus.com/bid/27492/info Nucleus CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...

Nucleus CMS 3.22 - 'action.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/27492/info Nucleus CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in...

Nucleus CMS 3.0.1 - myid SQL Injection

Nucleus CMS 3.0.1 - myid SQL Injection source: https://www.securityfocus.com/bid/27127/info Nucleus CMS is prone to an SQL-injection weakness because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Attackers can exploit this issue in conjunction with other...

Nucleus CMS 3.0.1 - 'myid' SQL Injection

source: https://www.securityfocus.com/bid/27127/info Nucleus CMS is prone to an SQL-injection weakness because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Attackers can exploit this issue in conjunction with other weaknesses in the application to bypass...

MoBiC-20: Nucleus CAPTCHA bypass

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation уязвимостях в капче Nucleus. Данная капча уязвима для half-automated method и injected constant captcha bypass method. Insufficient Anti-automation: Эксплоиты:...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Nucleus: CAPTCHA protection bypass...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Nucleus 3.01 allows remote attackers to inject arbitrary web script or HTML via the archive parameter...

CVE-2007-5429

Cross-site scripting XSS vulnerability in index.php in Nucleus 3.01 allows remote attackers to inject arbitrary web script or HTML via the archive parameter...

CVE-2007-5429

The CVE-2007-5429 entry concerns Nucleus CMS version 3.01, where the vulnerability exists in index.php via the archive parameter. The issue is a cross-site scripting (XSS) flaw that could allow remote attackers to inject arbitrary web script or HTML. The available connected documents confirm the ...

CVE-2007-5429

Cross-site scripting XSS vulnerability in index.php in Nucleus 3.01 allows remote attackers to inject arbitrary web script or HTML via the archive parameter...

Nucleus CMS 3.0.1 - index.php Cross-Site Scripting

Nucleus CMS 3.0.1 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/26035/info Nucleus CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...