PT-2021-24040 · Unknown · Anchor Cms

Unreal_Numb · Published 2021-12-15 · Updated 2022-01-05 · CVE-2021-44116

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Anchor CMS versions prior to 0.12.7

Description: A Cross Site Scripting (XSS) issue exists, allowing attackers to upload malicious code in the title and content of posts to obtain administrator cookies and perform other malicious operations.

Recommendations: For versions prior to 0.12.7, update to version 0.12.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the posts.php file to minimize the risk of exploitation. Avoid using the posts column to upload unvalidated user input until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-44116

GHSA-7MQ6-CP5M-F4J5

Affected Products

Anchor Cms

References · 5

• 🔥 https://cnblogs.com/unrealnumb/p/15573449.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-44116 · Security Note
• https://osv.dev/vulnerability/GHSA-7mq6-cp5m-f4j5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44116 · Vendor Advisory
• https://github.com/anchorcms/anchor-cms · Note