vendor:
Diesel Job Site 1.4
by:
indoushka
8.8
CVSS
HIGH
XSS, RFI, Admin Bypass, Bypass Settings
79, 94, 287, 639
CWE
Product Name: Diesel Job Site 1.4
Affected Version From: 1.4
Affected Version To: 1.4
Patch Exists: YES
Related CWE: N/A
CPE: a:diesel_job_site:diesel_job_site_1.4
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux
2009
Diesel Job Site 1.4 Multiple Vulnerabilities
The Diesel Job Site 1.4 is vulnerable to XSS, RFI, Admin Bypass, and Bypass Settings. An attacker can exploit these vulnerabilities by sending a malicious payload to the vulnerable parameters in the URL. For example, in the XSS vulnerability, an attacker can send a malicious script in the 'uname' and 'ename' parameters of the URL. For the RFI vulnerability, an attacker can send a malicious payload in the '_COOKIE[lang]' parameter of the URL. For the Admin Bypass vulnerability, an attacker can edit the email for the admin and search for the admin name, then submit the malicious payload in the 'forgot.php' page. Finally, for the Bypass Settings vulnerability, an attacker can send a malicious payload in the 'editsettings.php' page.
Mitigation:
The user should ensure that all the parameters in the URL are sanitized and validated before processing. The user should also ensure that the admin credentials are secure and not easily guessable.
