PT-2019-17573 · Yunu · Yunucms

Zhouxingixngo · Published 2019-01-04 · Updated 2019-01-10 · CVE-2019-5310

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.8

Description The issue allows for XSS due to crafted data being written to the sys.php file. This can be demonstrated by modifying the site title in an admin/system/basic POST request to "/admin/system/basic".

Recommendations For YUNUCMS version 1.1.8, consider restricting access to the vulnerable System.php controller until a patch is available. Avoid using the site title variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-5310

Affected Products

Yunucms

References · 3

• 🔥 https://github.com/doublefast/yunucms/issues/6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5310 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5310 · Vendor Advisory