full-disclosure - [CVE-2013-6239]Contexis 1.0 CMS, Reflected Xss

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 23 Oct 2013 13:38:44 +0200
From: Fran <jfrancisco.bolivar@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject:  [CVE-2013-6239]Contexis 1.0 CMS, Reflected Xss

CVE-2013-6239:Contexis 1.0 CMS, Reflected Xss

Severity: Medium

Vendor: exis-ti.com

Versions Affected: 1.0

Description: The contexist has be found the reflected XSS Vulnerability if
use the photo gallery model someone can insert xss code at the url
executing javascript codes on the web.

Exploit:

GET /publicas/galeria-imagenes/Galeria-XXXXX.html?action=detail&image=<XSS
code>

Solution: update to Contexis 2.0 CMS

Credit: This issue was discovered by  Juan Francisco Bolivar
es.linkedin.com/in/jfbolivar/

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6239
-- 

Un saludo, Juan Francisco

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/