PT-2012-1996 · Elxis · Elxis Cms

Henri Salo · Publicado 2012-08-29 · Atualizado 2018-10-09 · CVE-2011-4918

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Elxis CMS versions 2009.2 through 2009.3 Aphrodite before revision 2684

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the task parameter to "elxis/index.php" and PATH INFO to "elxis/administrator/index.php".

Recommendations For Elxis CMS versions 2009.2 through 2009.3 Aphrodite before revision 2684, update to a version that includes revision 2684 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-4918

Produtos afetados

Elxis Cms

Referências · 12

• 🔥 http://securityfocus.com/bid/50910 · Exploit
• 🔥 http://osvdb.org/77564 · Exploit
• 🔥 https://exploit-db.com/exploits/36407 · Exploit
• 🔥 http://osvdb.org/77563 · Exploit
• 🔥 https://exploit-db.com/exploits/36406 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4918 · Nota
• http://securityfocus.com/archive/1/520748/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4918 · Nota de Segurança
• http://openwall.com/lists/oss-security/2011/12/31/2 · Nota
• http://secunia.com/advisories/47073 · Aviso do Fabricante
• http://forum.elxis.org/index.php?PHPSESSID=v9i7kgmmb2554ldmlcmbj32ugjd0ngpc&topic=5144.msg43327#msg43327 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71648 · Nota