The Serendipity 2.5.0 allows remote attackers to execute arbitrary code via crafted input in a filename parameter in a serendipity_admin.php mediaFileUpload action. This vulnerability was discovered by Ahmet Ümit BAYRAM on 26.04.2024.
A remote attacker can exploit this vulnerability to influence or misrepresent web content
Serendipity is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The Proof of Concept (PoC) demonstrates two SQL injection vulnerabilities in the Serendipity Weblog application. The first PoC script retrieves the username and MD5 hashed password of the first author from the 'serendipity_authors' table. The second PoC is a URL that can be used in the browser to retrieve the username and password of the first author from the 'serendipity_authors' table.
If we load the poc.phar file in the image field while creating a category, we can run commands on the system. The exploit uses the payload '<?php echo system("cat /etc/passwd"); ?>' to execute the 'cat /etc/passwd' command on the system. The file with the payload is uploaded with a .phar extension.
An attacker who has the authority to create a new entry can execute a stored XSS attack by injecting malicious payload into the application.
Serendipity Freetag-plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.
Serendipity is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Services By CQR