full-disclosure - [FD] CVE Request: Fiyo CMS 2.0.6.1

Open Source and information security mailing list archives

Date: Mon, 29 Feb 2016 11:33:19 +0530
From: Himanshu Mehta <mehta.himanshu21@...il.com>
To: CVE ID Requests <cve-assign@...re.org>, fulldisclosure@...lists.org,
 vuln@...unia.com, 
 bugs@...uritytracker.com, submissions@...ketstormsecurity.org, 
 bugtraq@...urityfocus.com
Subject: [FD] CVE Request: Fiyo CMS 2.0.6.1 - Multiple XSS Vulnerabilities

*1. Introduction*

Affected Product:      Fiyo CMS 2.0.6.1
Fixed in:                    2.0.6.2
Vendor Website:       http://www.fiyo.org/
Vulnerability Type:    XSS
Remote Exploitable: Yes

*2. Overview*

There are multiple XSS vulnerabilities in Fiyo CMS 2.0.6.1. The
vulnerabilities exist due to insufficient filtration of user-supplied data.
A remote attacker can execute arbitrary HTML and script code in browser in
context of the vulnerable application.

*3. Affected Modules*

Affected fields in the modules are listed below:

i. Module: Dashboard->Users ->User List
Section: User Group
Field: Group Name

ii. Module: Dashboard->Users->New User
Section: Login Data
Field: Nama Lengkap

*4. Payload*
<script>alert('XSS')</script>

*5. Credit*
Himanshu Mehta
mehta.himanshu21@...il.com

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives