PT-2020-7775 · Fork Cms · Fork Cms

Published 2020-02-08 · Updated 2020-02-12 · CVE-2014-9470

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Fork CMS versions prior to 3.8.4

Description: A cross-site scripting (XSS) issue exists due to insufficient input validation in the loadForm function. This allows remote attackers to inject arbitrary web script or HTML via the q widget parameter to the "en/search" endpoint.

Recommendations: For versions prior to 3.8.4, update to version 3.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the loadForm function in Frontend/Modules/Search/Actions/Index.php until a patch is available. Avoid using the q widget parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-9470

Affected Products

Fork Cms

References · 7

• 🔥 http://seclists.org/fulldisclosure/2015/Jan/38 · Exploit
• https://github.com/forkcms/forkcms/commit/4a7814762adf4f56f932d95146c7e4126d872114 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-9470 · Security Note
• http://fork-cms.com/blog/detail/fork-3.8.4-released · Vendor Advisory
• https://github.com/forkcms/forkcms/issues/1018s · Note
• http://itas.vn/news/itas-team-found-out-a-cross-site-scripting-vulnerability-in-fork-cms-70.html · Note
• http://securityfocus.com/bid/72017 · Note