PT-2020-15666 · Mara · Mara Cms

George Tsimpidas · Published 2020-08-30 · Updated 2022-11-08 · CVE-2020-24223

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mara CMS version 7.5

Description The issue allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters. This means an attacker could potentially inject malicious scripts into the website, affecting users who visit the compromised page.

Recommendations For Mara CMS version 7.5, as a temporary workaround, consider restricting access to the contact.php page or disabling the theme and pagetheme parameters until a patch is available. Avoid using the theme and pagetheme parameters in the affected contact.php page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-24223

Affected Products

Mara Cms

References · 6

• 🔥 https://github.com/FreySolarEye/CVE/blob/master/Mara%20CMS%207.5%20-%20Cross%20Site%20Scripting · Exploit
• 🔥 http://packetstormsecurity.com/files/158728/Mara-CMS-7.5-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/48777 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-24223 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24223 · Vendor Advisory
• https://t.me/cvenotify/37240 · Telegram Post