Bugtraq mailing list archives
[Suspected Spam]New vulnerabilities in CMS SiteLogic
From: "MustLive" <mustlive () websecurity com ua>
Date: Sun, 18 Apr 2010 18:05:14 +0300
Hello Bugtraq!I want to warn you about new security vulnerabilities in CMS SiteLogic. It's Ukrainian commercial CMS. In addition to previously reported vulnerabilities, I will report about vulnerabilities in this CMS, which I disclosed in 2009 (it's second advisory with vulnerabilities which I disclosed last year).
----------------------------- Advisory: New vulnerabilities in CMS SiteLogic ----------------------------- URL: http://websecurity.com.ua/3580/ ----------------------------- Affected products: all versions of CMS SiteLogic. ----------------------------- Timeline: 16.01.2009 - found XSS vulnerability. 06.04.2009 - found Command Execution vulnerability.28.06.2009 - when I was informing developers about previous holes (which I wrote about in previous advisory), I mentioned them that there are many other holes in their CMS (but they ignored as previous holes, as new ones).
10.10.2009 - disclosed at my site. 11.10.2009 - additionally informed developers. ----------------------------- Details: These are Cross-Site Scripting and Command Execution vulnerabilities. XSS: http://site/?mid=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E Command Execution:It's possible to upload arbitrary files (shell upload) via module “Banner system” in admin panel.
Best wishes & regards, MustLive Administrator of Websecurity web sitehttp://websecurity.com.ua
Current thread:
- [Suspected Spam]New vulnerabilities in CMS SiteLogic MustLive (Apr 19)
- Re: [Suspected Spam]New vulnerabilities in CMS SiteLogic Salvatore Fresta aka Drosophila (Apr 20)
- Re: New vulnerabilities in CMS SiteLogic MustLive (Apr 26)
- Message not available
- New vulnerabilities in CMS SiteLogic Salvatore Fresta aka Drosophila (Apr 26)
- Re: New vulnerabilities in CMS SiteLogic MustLive (Apr 26)
- Re: [Suspected Spam]New vulnerabilities in CMS SiteLogic Salvatore Fresta aka Drosophila (Apr 20)