The vulnerability in liveSite Version 2019.1 allows an attacker to execute arbitrary code remotely. By creating a campaign with a specific payload, an attacker can view sensitive system information like the contents of '/etc/passwd'.
This vulnerability is in the authentication state and is located in the CMS management panel. There are two vulnerabilities: Vuln One and Vuln Two. Vuln One is in the URI POST /ulicms/admin/index.php?action=languages with parameter name. Vuln Two is in the URI POST /ulicms/admin/index.php?action=pages_edit&page=23 with parameter systemname.
UliCMS 2019.2 and 2019.1 are vulnerable to multiple Cross-Site Scripting (XSS) attacks. The first vulnerability is located in the 'go' parameter of the '/ulicms/admin/inc/loginform.php' file. The second vulnerability is located in the 'go' parameter of the '/ulicms/admin/inc/registerform.php' file. The third vulnerability is located in the 'error' parameter of the '/ulicms/admin/index.php' file and requires authentication. An attacker can exploit these vulnerabilities to execute arbitrary HTML and script code in the browser of the victim.
Services By CQR