The Serendipity 2.5.0 allows remote attackers to execute arbitrary code via crafted input in a filename parameter in a serendipity_admin.php mediaFileUpload action. This vulnerability was discovered by Ahmet Ümit BAYRAM on 26.04.2024.
A remote attacker can exploit this vulnerability to influence or misrepresent web content
Serendipity is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Serendipity is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
If we load the poc.phar file in the image field while creating a category, we can run commands on the system. The exploit uses the payload '<?php echo system("cat /etc/passwd"); ?>' to execute the 'cat /etc/passwd' command on the system. The file with the payload is uploaded with a .phar extension.
An attacker who has the authority to create a new entry can execute a stored XSS attack by injecting malicious payload into the application.
The already authenticated attacker can upload HTML files on the server, which is absolutely dangerous and STUPID. In this file, the attacker can be codding a malicious web-socket responder that can connect with some nasty webserver somewhere. It depends on the scenario, the attacker can steal every day very sensitive information, for a very long period of time, until the other users will know that something is not ok with this system, and they decide to stop using her, but maybe they will be too late for this decision.
S9Y Serendipity is prone to an HTML-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.
Serendipity is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
The Serendipity 1.7.5 backend is prone to multiple security vulnerabilities. Stored-XSS can be executed by setting the 'Real name' field to a malicious script. SQL-Injection can be executed by sending a malicious payload to the 'serendipity[install_plugin]' parameter. Reflected XSS_1, Reflected XSS_2 and Reflected XSS_3 can be executed by sending malicious payloads to the 'serendipity[install_plugin]', 'serendipity[id]' and 'serendipity[timestamp]' parameters respectively.
Services By CQR