PT-2015-5276 · Gecko · Gecko Cms

Gjoko Krstic · Published 2015-01-29 · Updated 2017-09-08 · CVE-2015-1422

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Gecko CMS versions 2.2 through 2.3

Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in admin/index.php and js/editor/plugins/filemanager/dialog.php. The vulnerable parameters include horder[], jak catid, jak content, jak css, jak delete log[], jak email, jak extfile, jak file, jak hookshow[], jak img, jak javascript, jak lcontent, jak name, jak password, jak showcontact, jak tags, jak title, jak url, jak username, real hook id[], sp, sreal plugin id[], ssp, and sssp in admin/index.php, as well as editor, field id, fldr, lang, popup, subfolder, and type in js/editor/plugins/filemanager/dialog.php.

Recommendations For Gecko CMS versions 2.2 through 2.3, consider disabling access to the admin/index.php and js/editor/plugins/filemanager/dialog.php files until a patch is available. Restrict input for the vulnerable parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-1422

Affected Products

Gecko Cms

References · 9

• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2015-5222.php · Exploit
• 🔥 http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/35767 · Exploit
• 🔥 http://exploit-db.com/exploits/35767 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-1422 · Security Note
• http://osvdb.org/show/osvdb/116970 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99977 · Note
• http://osvdb.org/show/osvdb/116967 · Note
• http://osvdb.org/show/osvdb/116969 · Note