CVE-2009-1463

Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file...

CVE-2009-1458

CVE-2009-1458 affects razorCMS prior to 0.4. The admin/index.php file contains multiple XSS flaws that allow remote attackers to inject arbitrary web script or HTML via (1) slab in the edit action, (2) catname in showcats, and (3) cat in reordercat. Impact is web-script/HTML injection without use...

CVE-2009-1462

The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact...

CVE-2009-1460

razorCMS before 0.4 uses weak permissions for 1 admin/core/adminconfig.php, which allows local users to obtain the administrator's password hash and FTP user credentials; and 2 the root directory, 3 datastore/, and 4 admin/core/, which allows local users to have an unspecified impact...

CVE-2009-1458

Multiple cross-site scripting XSS vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the slab parameter in an edit action, 2 the catname parameter in a showcats action, and 3 the cat parameter in a reordercat action...

CVE-2009-1460

CVE-2009-1460 affects razorCMS before 0.4. The issue is weak file system permissions: admin/core/admin_config.php exposes the administrator password hash and FTP credentials to local users; the root directory, datastore/, and admin/core/ also have insufficient permissions, allowing local users to...

CVE-2009-1462

The CVE-2009-1462 entry concerns razorCMS prior to version 0.4, where the Security Manager does not verify the permissions of every file owned by the Apache user, conflicting with documentation. This could enable local users to cause an unspecified impact. The provided documents do not detail the...

CVE-2009-1461

Cross-site scripting XSS vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Page Title field...

Razor CMS 0.3RC2 XSS / Disclosure / Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Multiple Vulnerability Disclosure for razorCMS - ---------------------------------------------- A recent security audit has uncovered multiple security vulnerabilities in the latest version 0.3RC2 and all previous versions of razorCMS CORE by Morgan...

RazorCMS 0.3RC2 - Multiple Vulnerabilities

RazorCMS 0.3RC2 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/34566/info razorCMS is prone to a local information-disclosure vulnerability, a local access-validation vulnerability, a security-bypass vulnerability, and multiple cross-site-scripting vulnerabilities. Attackers...

RazorCMS 0.3RC2 - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/34566/info razorCMS is prone to a local information-disclosure vulnerability, a local access-validation vulnerability, a security-bypass vulnerability, and multiple cross-site-scripting vulnerabilities. Attackers can exploit these issues to gain access to...