lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 2 Feb 2015 20:19:30 +0800
From: Jing Wang <justqdjing@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] CVE-2014-9562 OptimalSite Content Management System (CMS) XSS
 (Cross-Site Scripting) Security Vulnerabilities

*CVE-2014-9562 OptimalSite Content Management System (CMS) XSS (Cross-Site
Scripting) Security Vulnerabilities*





Exploit Title:  OptimalSite CMS /display_dialog.php image Parameter XSS
Security Vulnerability
Vendor: OptimalSite
Product: OptimalSite Content Management System (CMS)
Vulnerable Versions: V.1 V2.4
Tested Version: V.1 V2.4
Advisory Publication: Feb 2, 2015
Latest Update: Feb 2, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-9562
CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU),
Singapore]








*Advisory Details:*

*(1) Vendor & Product Description*

*Vendor:*
OptimalSite


*Product & Version:*
OptimalSite Content Management System (CMS)
V.1
V2.4


*Vendor URL & Download:*
http://www.optimalsite.com/en/



*Product Description:*
“Content management system OptimalSite is an online software package that
enables the management of information published on a website.”

“OptimalSite consists of the system core and integrated modules, which
allow expanding website possibilities and functionality. You may select a
set of modules that suits your needs best.”





*(2) Vulnerability Details:*
OptimalSite Content Management System (CMS) has a security problem. It can
be exploited by XSS attacks.

*(2.1) *The vulnerability occurs at “display_dialog.php” page with “image”
parameter.







*References:*
http://tetraph.com/security/cves/cve-2014-9562-optimalsite-content-management-system-cms-xss-cross-site-scripting-security-vulnerabilities/
http://securityrelated.blogspot.com/2015/02/cve-2014-9562-optimalsite-content.html
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9562
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9562
https://security-tracker.debian.org/tracker/CVE-2014-9562
http://www.cvedetails.com/cve/CVE-2014-9562/
http://www.security-database.com/detail.php?alert=CVE-2014-9562
http://packetstormsecurity.com/files/cve/CVE-2014-9562
http://www.pentest.it/cve-2014-9562.html
http://www.naked-security.com/cve/CVE-2014-9562/
http://007software.net/cve-2014-9562/
https://security-tracker.debian.org/tracker/CVE-2014-9562








--
Wang Jing,
Division of Mathematical Sciences (MAS),
School of Physical and Mathematical Sciences (SPMS),
Nanyang Technological University (NTU),
Singapore.
http://www.tetraph.com/wangjing/

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists