PT-2018-9677 · Joyplus · Joyplus-Cms

Published 2018-04-13 · Updated 2018-05-11 · CVE-2018-10096

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: joyplus-cms version 1.6.0

Description: The issue concerns a Cross-Site Scripting (XSS) problem. It is exploited through the device name parameter in a "manager/admin ajax.php?action=save flag=add" request, specifically the "/manager/admin ajax.php?action=save&flag=add" API endpoint.

Recommendations: For joyplus-cms version 1.6.0, as a temporary workaround, consider restricting access to the "manager/admin ajax.php?action=save&flag=add" API endpoint to minimize the risk of exploitation. Avoid using the device name parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-10096

Affected Products

Joyplus-Cms

References · 3

• 🔥❌ https://github.com/joyplus/joyplus-cms/issues/424 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2018-10096 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10096 · Security Note