When using the 'insert media' feature in SilverStripe 5.3.8, the oEmbed JSON linked includes an unsanitized HTML attribute, allowing an attacker to execute a script payload on both the CMS and the website's front-end.
An attacker can exploit this vulnerability to rename uploaded files on the affected webserver. Successful exploits may allow attackers to execute arbitrary code within the context of the affected webserver.
SilverStripe is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.
SilverStripe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
SilverStripe is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.
SilverStripe is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing attacks; other attacks are possible.
Pixlr Image Editor is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
SilverStripe CMS is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability and Cross-Site Request Forgeries (CSRF). The site title field in the configuration page fails to securely output encode stored values. As a result, an authenticated attacker can trigger the application to store a malicious string by entering the values into the site title field. When a user visits the web site, the malicious code will be executed in the client browser. The privilege escalation is possible because the form used to change user account passwords does not require the user to confirm their current password and is vulnerable to CSRF. An attacker can reset an Administrator password by creating a malicious web site that sends a POST request to change the current user's password while they are logged into the CMS.
In the CSV export feature of the SilverStripe CMS, it's possible for the output to contain macros and scripts, which if imported without sanitization into software (including Microsoft Excel) may be executed.
Services By CQR