lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 2 Feb 2015 20:19:30 +0800
From: Jing Wang <>
Subject: [FD] CVE-2014-9562 OptimalSite Content Management System (CMS) XSS
 (Cross-Site Scripting) Security Vulnerabilities

*CVE-2014-9562 OptimalSite Content Management System (CMS) XSS (Cross-Site
Scripting) Security Vulnerabilities*

Exploit Title:  OptimalSite CMS /display_dialog.php image Parameter XSS
Security Vulnerability
Vendor: OptimalSite
Product: OptimalSite Content Management System (CMS)
Vulnerable Versions: V.1 V2.4
Tested Version: V.1 V2.4
Advisory Publication: Feb 2, 2015
Latest Update: Feb 2, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-9562
CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU),

*Advisory Details:*

*(1) Vendor & Product Description*


*Product & Version:*
OptimalSite Content Management System (CMS)

*Vendor URL & Download:*

*Product Description:*
“Content management system OptimalSite is an online software package that
enables the management of information published on a website.”

“OptimalSite consists of the system core and integrated modules, which
allow expanding website possibilities and functionality. You may select a
set of modules that suits your needs best.”

*(2) Vulnerability Details:*
OptimalSite Content Management System (CMS) has a security problem. It can
be exploited by XSS attacks.

*(2.1) *The vulnerability occurs at “display_dialog.php” page with “image”


Wang Jing,
Division of Mathematical Sciences (MAS),
School of Physical and Mathematical Sciences (SPMS),
Nanyang Technological University (NTU),

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists