PT-2018-17944 · Rainlab+1 · Rainlab Blog Plugin+1

Samrat Das · Published 2018-02-18 · Updated 2022-05-13 · CVE-2018-7198

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October CMS versions through 1.0.431 The RainLab Blog Plugin used in October CMS versions through 1.0.431

Description The issue allows for XSS by entering HTML on the Add Posts page. This can be exploited through the RainLab Blog Plugin.

Recommendations For October CMS versions through 1.0.431, update to a version that includes a fix for this issue. For The RainLab Blog Plugin used in October CMS versions through 1.0.431, consider disabling the plugin until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-7198

GHSA-96MH-7XPR-QCGW

Affected Products

October Cms

Rainlab Blog Plugin

References · 7

• 🔥 https://exploit-db.com/exploits/44144 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7198 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7198 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-96mh-7xpr-qcgw · Vendor Advisory
• https://github.com/rainlab/blog-plugin · Note
• https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94 · Note
• http://securitywarrior9.blogspot.com/2018/02/html-injection-october-cms.html · Note