vendor:
Power System Of Article Management
by:
Pouya_Server
7.5
CVSS
HIGH
DD/XSS
79
CWE
Product Name: Power System Of Article Management
Affected Version From: 3
Affected Version To: 3
Patch Exists: NO
Related CWE: N/A
CPE: a:pouya_server:power_system_of_article_management
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Power System Of Article Management 3.0 DD/XSS Vulnerability
A vulnerability exists in Power System Of Article Management 3.0 which allows an attacker to inject malicious code into the vulnerable application. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The vulnerability is due to insufficient sanitization of user-supplied input to the 'ComeUrl' parameter in the 'userchklogin.asp' and 'userlogin.asp' scripts. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. Successful exploitation may allow an attacker to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Mitigation:
Input validation should be used to ensure that user-supplied input is properly sanitized.
