vendor:
Stradus CMS
by:
DaOne aka Mocking Bird
8,8
CVSS
HIGH
File Upload, XSS, SQL Injection
79, 89, 89
CWE
Product Name: Stradus CMS
Affected Version From: 1.0beta4
Affected Version To: 1.0beta4
Patch Exists: NO
Related CWE: N/A
CPE: stradus.eu
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Apache/2.2.8(Win32) PHP/5.2.6
2013
Stradus CMS Multiple Vulnerabilities
The Stradus CMS is vulnerable to File Upload, XSS and SQL Injection. The File Upload vulnerability can be exploited by sending a malicious file to the upload.php page in the moduls/photo_album/ and moduls/simply_image/ directories. The XSS and SQL Injection vulnerabilities can be exploited by sending malicious input to the log_view.php page in the adminfiles/ directory and the new.php page in the moduls/photo_album/ directory.
Mitigation:
Ensure that all user-supplied input is properly validated and sanitized before being used in the application. Use a web application firewall to detect and block malicious input.
