vendor:
Qool CMS
by:
Gjoko 'LiquidWorm' Krstic
7,5
CVSS
HIGH
Multiple HTML and JavaScript Injection
79
CWE
Product Name: Qool CMS
Affected Version From: 2.0 RC2
Affected Version To: 2.0 RC2
Patch Exists: NO
Related CWE: N/A
CPE: a:qool_cms:qool_cms:2.0_rc2
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Microsoft Windows 7 Ultimate SP1 (EN), Apache 2.4.2 (Win32), PHP 5.4.4, MySQL 5.5.25a
2013
Qool CMS v2.0 RC2 Multiple HTML And JavaScript Injection Vulnerabilities
Qool CMS is prone to multiple HTML and JavaScript injection vulnerabilities because it fails to properly sanitize user-supplied data before using it in the application's generated HTML output.
Mitigation:
Input validation and output encoding should be used to prevent HTML and JavaScript injection attacks.