Multiple vulnerability in jupiter CMS

2006-04-10T00:00:00
ID SECURITYVULNS:DOC:12132
Type securityvulns
Reporter Securityvulns
Modified 2006-04-10T00:00:00

Description

Author : KaDaL-X email : king_purba@yahoo.co.uk site : http://kandangjamur.net/

Multiple vulnerability in jupiter CMS Vendor : http://www.highstrike.net/ version 1.1.5

Vulnerability code found in file modules/online.php

PoC:

XSS http://xxx/jupiter/jupiter/index.php?n=modules/online&&a=1&language=1&layout=%3Ch1%3E%3Cmarquee%3Ealooo

FIX: Create a validation function to fix the bugs, you can use htmlspecialchars() function to fix this security issue

Full Path disclosure http://xxxx/jupiter/jupiter/modules/online.php

FIX: Turn off display error

Note : Sorry, but vendor site is also vuln with this bugs