vendor:
IsWeb CMS
by:
XaDoS (SecurityCode Team)
7.5
CVSS
HIGH
Blind $qL Injection and XSS
89 (SQL Injection) and 79 (XSS)
CWE
Product Name: IsWeb CMS
Affected Version From: 3
Affected Version To: 3
Patch Exists: NO
Related CWE: N/A
CPE: a:cmsisweb:isweb_cms
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
IsWeb CMS v 3.0 ($qL/XsS) Multiple vulnerabilities
IsWeb CMS v 3.0 is vulnerable to Blind $qL Injection and XSS. An attacker can inject malicious SQL queries in the vulnerable parameter 'id_sezione' and execute arbitrary SQL commands in the database. An attacker can also inject malicious JavaScript code in the vulnerable parameter 'azione' and 'id_doc' and execute arbitrary JavaScript code in the victim's browser.
Mitigation:
Input validation should be used to prevent SQL Injection and XSS attacks. Sanitize user input and escape special characters.
