PT-2012-1996 · Elxis · Elxis Cms

Henri Salo · Published 2012-08-29 · Updated 2018-10-09 · CVE-2011-4918

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Elxis CMS versions 2009.2 through 2009.3 Aphrodite before revision 2684

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the task parameter to "elxis/index.php" and PATH INFO to "elxis/administrator/index.php".

Recommendations For Elxis CMS versions 2009.2 through 2009.3 Aphrodite before revision 2684, update to a version that includes revision 2684 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-4918

Affected Products

Elxis Cms

References · 12

• 🔥 http://securityfocus.com/bid/50910 · Exploit
• 🔥 http://osvdb.org/77564 · Exploit
• 🔥 https://exploit-db.com/exploits/36407 · Exploit
• 🔥 http://osvdb.org/77563 · Exploit
• 🔥 https://exploit-db.com/exploits/36406 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4918 · Security Note
• http://secunia.com/advisories/47073 · Vendor Advisory
• http://forum.elxis.org/index.php?PHPSESSID=v9i7kgmmb2554ldmlcmbj32ugjd0ngpc&topic=5144.msg43327#msg43327 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4918 · Note
• http://securityfocus.com/archive/1/520748/100/0/threaded · Note
• http://openwall.com/lists/oss-security/2011/12/31/2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71648 · Note