vendor:
CMS-DB
by:
cp77fk4r
8.8
CVSS
HIGH
Cross-Site Request Forgery, Cross-Site Scripting and Full Path Disclosure
352, 79, 200
CWE
Product Name: CMS-DB
Affected Version From: v0.7.13
Affected Version To: v0.7.13
Patch Exists: NO
Related CWE: N/A
CPE: a:cms-db:cms-db
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
Cross-Site Request Forgery, Cross-Site Scripting and Full Path Disclosure in CMS-DB v0.7.13
Cross-Site Request Forgery (CSRF) vulnerability exists in CMS-DB v0.7.13 which allows an attacker to add a super-user, delete a user and set FTP server login. Cross-Site Scripting (XSS) vulnerability exists in CMS-DB v0.7.13 which allows an attacker to inject malicious JavaScript code into the application. Full Path Disclosure vulnerability exists in CMS-DB v0.7.13 which allows an attacker to view the full path of the application.
Mitigation:
To mitigate CSRF vulnerability, the application should use anti-CSRF tokens. To mitigate XSS vulnerability, the application should use input validation and output encoding. To mitigate Full Path Disclosure vulnerability, the application should use error handling and logging.
