Summary
This host is running GetSimple CMS and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow remote attackers to inject HTML code or steal the victim's cookie-based authentication credentials.
Impact Level: Application
Solution
No solution or patch was made available for at least one year since disclosure of this vulnerability. Likely none will be provided anymore.
General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.
Insight
Flaw exists in upload.php, theme.php, pages.php, settings.php and index.php scripts, which fail to properly sanitize user-supplied input to 'path', 'err', 'error' and 'success' parameter and 'Custom Permalink Structure', 'Display name', 'Email Address' fields
Affected
GetSimple CMS 3.1, 3.1.2, 3.2.3, Other versions may also be affected.
Detection
Send a crafted string via HTTP GET request and check whether it is able to inject HTML code.
References
Severity
Classification
-
CVE CVE-2012-6621, CVE-2013-7243 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities
- Aker Secure Mail Gateway Cross-Site Scripting Vulnerability
- Adobe BlazeDS XML and XML External Entity Injection Vulnerabilities
- Apache Struts Showcase Multiple Persistence Cross-Site Scripting Vulnerabilities
- Apache Tomcat Information Disclosure Vulnerability
- 1024 CMS 1.1.0 Beta 'force_download.php' Local File Include Vulnerability