header-logo
Suggest Exploit
vendor:
AneCMS
by:
Penguin
8.3
CVSS
HIGH
Persistant XSS
79
CWE
Product Name: AneCMS
Affected Version From: 1.3
Affected Version To: 1.3
Patch Exists: NO
Related CWE: N/A
CPE: anecms.com/anecms.zip
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Linux
2011

AneCMS 1.3 Persistant XSS

You can add blogpost comments that does not get filtered for HTML-Code. Simply add an Comment with for example the Content <script>alert(1337);</script> Your <script> code will get executed by every visitor who reads the comments!

Mitigation:

No Bugfix
Source

Exploit-DB raw data:

# Exploit Title: AneCMS 1.3 Persistant XSS
# Date: 17.1.2011
# Author: Penguin
# Visit: www.null-sector.info
# Software Link: http://anecms.com/anecms.zip
# Version: 1.3
# Tested on: Linux

(I) Vulnerability
----------------------
You can add blogpost comments that does not get filtered for HTML-Code.
Simply add an Comment with for example the Content <script>alert(1337);</script>
Your <script> code will get executed by every visitor who reads the comments!

(II) Bug Fix
----------------------
There's no Bugfix :)

Navigation

Suggest Exploit

Services By CQR