vendor:
GetSimple CMS
by:
Pedro Ribeiro
7,5
CVSS
HIGH
Reflected XSS and Persistent XSS
79
CWE
Product Name: GetSimple CMS
Affected Version From: 3.3.1
Affected Version To: 3.3.1
Patch Exists: YES
Related CWE: CVE-2014-1603
CPE: a:get-simple-cms:get-simple-cms:3.3.1
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2014
PoC for XSS bugs in the admin console of GetSimple CMS 3.3.1
Reflected XSS can be exploited by sending a maliciously crafted URL to the vulnerable application. The malicious URL contains a script which is executed by the vulnerable application. Persistent XSS can be exploited by sending a maliciously crafted form to the vulnerable application. The malicious form contains a script which is stored by the vulnerable application and executed when the stored data is retrieved.
Mitigation:
Input validation, output encoding, and proper access control should be implemented to prevent XSS attacks.
