CVE-2009-1460

CVE-2009-1460 affects razorCMS before 0.4. The issue is weak file system permissions: admin/core/admin_config.php exposes the administrator password hash and FTP credentials to local users; the root directory, datastore/, and admin/core/ also have insufficient permissions, allowing local users to...

CVE-2009-1463

The CVE-2009-1463 entry affects razorCMS prior to version 0.4. The issue is a static code injection flaw that lets remote attackers save content as a .php file, enabling arbitrary PHP execution on affected pages. The underlying cause is improper handling of content/file saves that allows code to ...

CVE-2009-1458

Multiple cross-site scripting XSS vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the slab parameter in an edit action, 2 the catname parameter in a showcats action, and 3 the cat parameter in a reordercat action...

CVE-2009-1461

CVE-2009-1461 describes a cross-site scripting (XSS) vulnerability in the Create New Page form of razorCMS 0.3 RC2 and earlier. The issue allows remote authenticated users to inject arbitrary script or HTML via the Page Title field. Affected component is the Create New Page workflow; vulnerabilit...

CVE-2009-1462

The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact...

CVE-2009-1462

The CVE-2009-1462 entry concerns razorCMS prior to version 0.4, where the Security Manager does not verify the permissions of every file owned by the Apache user, conflicting with documentation. This could enable local users to cause an unspecified impact. The provided documents do not detail the...

CVE-2009-1460

razorCMS before 0.4 uses weak permissions for 1 admin/core/adminconfig.php, which allows local users to obtain the administrator's password hash and FTP user credentials; and 2 the root directory, 3 datastore/, and 4 admin/core/, which allows local users to have an unspecified impact...

CVE-2009-1459

The CVE-2009-1459 issue targets razorCMS with a Cross‑Site Request Forgery vulnerability in versions before 0.4. The flaw allows an attacker to hijack an administrator’s session and perform actions that create a web page containing PHP code, potentially impacting authentication and content integr...

RazorCMS 0.3RC2 - Multiple Vulnerabilities

RazorCMS 0.3RC2 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/34566/info razorCMS is prone to a local information-disclosure vulnerability, a local access-validation vulnerability, a security-bypass vulnerability, and multiple cross-site-scripting vulnerabilities. Attackers...

Razor CMS 0.3RC2 XSS / Disclosure / Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Multiple Vulnerability Disclosure for razorCMS - ---------------------------------------------- A recent security audit has uncovered multiple security vulnerabilities in the latest version 0.3RC2 and all previous versions of razorCMS CORE by Morgan...

RazorCMS 0.3RC2 - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/34566/info razorCMS is prone to a local information-disclosure vulnerability, a local access-validation vulnerability, a security-bypass vulnerability, and multiple cross-site-scripting vulnerabilities. Attackers can exploit these issues to gain access to...