PT-2008-2320 · Crux · Cruxcms

Published 2008-02-12 · Updated 2008-09-05 · CVE-2008-0700

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CruxCMS version 3.0

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the search parameter in the "search.php" file.

Recommendations For version 3.0, update the search.php file to properly sanitize the search parameter to prevent injection of arbitrary web script or HTML. As a temporary workaround, consider restricting access to the search functionality until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0700

Affected Products

Cruxcms

References · 5

• 🔥 https://exploit-db.com/exploits/31097 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0700 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0700 · Note
• http://downloads.securityfocus.com/vulnerabilities/exploits/27588.html · Note
• http://securityfocus.com/bid/27588 · Note