PT-2021-11134 · Csz Cms · Csz Cms+1

R0Ck3T · Published 2021-07-09 · Updated 2021-07-12 · CVE-2020-25392

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: CSZ CMS version 1.2.9

Description: A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the New Article field under the Article plugin. This enables attackers to potentially manipulate the website's content or steal user data.

Recommendations: For CSZ CMS version 1.2.9, consider disabling the Article plugin until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the New Article field to minimize the risk of malicious payload injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-25392

Affected Products

Article

Csz Cms

References · 4

• 🔥 https://sourceforge.net/p/cszcms/tickets/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25392 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25392 · Vendor Advisory
• https://t.me/cvenotify/17370 · Telegram Post