Grayscale BandSite CMS Multiple Input Validation Vulnerabilities

vendor:

BandSite CMS

by:

SecurityFocus

7.5

CVSS

HIGH

Multiple Input Validation Vulnerabilities

CWE

Product Name: BandSite CMS

Affected Version From: 1.1.2000

Affected Version To: 1.1.2000

Patch Exists: N/A

Related CWE: N/A

CPE: //a:grayscale_bandsite_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

Grayscale BandSite CMS Multiple Input Validation Vulnerabilities

Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data. These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to execute unintended commands.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/20137/info
                     
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
                     
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
                     
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/footer.php?this_year=<script>alert(document.cookie);</script>