4.3

CVE-2011-4918

Exploit
Multiple cross-site scripting (XSS) vulnerabilities in Elxis CMS 2009.2, 2009.3 and 2009.3 Aphrodite before revision 2684 allow remote attackers to inject arbitrary web script or HTML via the (1) task parameter to elxis/index.php, and (2) PATH_INFO to elxis/administrator/index.php.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Elxis ≫ Elxis Cms Version2009.2
Elxis ≫ Elxis Cms Version2009.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.11% 0.793
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://forum.elxis.org/index.php?PHPSESSID=v9i7kgmmb2554ldmlcmbj32ugjd0ngpc&topic=5144.msg43327#msg43327
Patch
http://secunia.com/advisories/47073
Vendor Advisory
http://www.openwall.com/lists/oss-security/2011/12/31/2
http://www.osvdb.org/77563
Exploit
http://www.osvdb.org/77564
Exploit
http://www.securityfocus.com/archive/1/520748/100/0/threaded
http://www.securityfocus.com/bid/50910
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/71648