vendor:
YouTube Automated CMS
by:
Arbin Godar
8,8
CVSS
HIGH
Cross-Site Request Forgery (CSRF) to Persistent Cross-Site Scripting (XSS)
352
CWE
Product Name: YouTube Automated CMS
Affected Version From: 1.0.1
Affected Version To: 1.0.7
Patch Exists: NO
Related CWE: N/A
CPE: a:codecanyon:youtube_automated_cms
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2016
YouTube Automated CMS 1.0.1 / 1.0.7 – CSRF to Persistent XSS
An attacker is able to execute JavaScript and perform CSRF on a web application using YouTube Automated CMS, which allows an attacker to create a post when an authenticated user/admin browses a specially crafted web page. The title parameter was not filtering special characters, making it vulnerable to XSS. An attacker can create a CSRF exploit code for posting an article with XSS alert JavaScript payload as the title of the post. If the attacker is able to perform the CSRF attack successfully, the XSS will be triggered when someone opens the site using YouTube Automated CMS.
Mitigation:
Ensure that all user input is properly sanitized and filtered to prevent XSS attacks. Implement CSRF protection mechanisms such as anti-CSRF tokens and same-site cookies.
