Vulners
Lucene search
Limny 3.0.1 (login.php) Remote URI Based Cross-Site Scripting Vulnerability
| Reporter | Title | Published | Views | Family All 7 |
|---|---|---|---|---|
 | CVE-2012-5343 | 4 Jan 201200:00 | – | circl |
 | CVE-2012-5343 | 9 Oct 201215:00 | – | cve |
 | CVE-2012-5343 | 9 Oct 201215:00 | – | cvelist |
 | EUVD-2012-5265 | 7 Oct 202500:30 | – | euvd |
 | CVE-2012-5343 | 9 Oct 201215:55 | – | nvd |
 | Limny 'login.php' Script XSS Vulnerability | 12 Oct 201200:00 | – | openvas |
 | Cross site scripting | 9 Oct 201215:55 | – | prion |
<html><body><p>Limny 3.0.1 (login.php) Remote URI Based Cross-Site Scripting Vulnerability
Vendor: Hamidreza Samak
Product web page: http://www.limny.org
Affected version: 3.0.1
Summary: Limny is a free and open-source content management framework
with a focus on ease to use and develop. It can be used as a stable
and powerful core for heavy and light web applications by having main
features of web applications such as user management, multilingual system
and multiple theme support. Also its rich graphic library helps designers
to create colorable themes instead of designing multiple themes.
Desc: Limny suffers from a XSS issue in '/admin/login.php' that uses the
'PHP_SELF' variable. The vulnerability is present because there isn't any
filtering to the mentioned variable in the affected script. Attackers can
exploit this weakness to execute arbitrary HTML and script code in a user's
browser session.
=======================================================================
/admin/login.php:
-----------------------------------
100: </p><form action="<?php print $_SERVER['PHP_SELF']; ?>" method="post" name="limny_login">
=======================================================================
Tested on: Microsoft Windows XP Professional SP3 (EN)
Apache 2.2.21
MySQL 5.5.16
PHP 5.3.8
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2012-5066
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5066.php
04.01.2012
---
PoC:
http://localhost/admin/login.php/"/><script>alert('zsl')</script>
</form></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Jan 2012 00:00Current
6.1Medium risk
Vulners AI Score6.1
CVSS 24.3
EPSS0.09462