SyndeoCMS is prone to a local file-include, a cross-site scripting, and an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input. Exploiting the local file-include issue allows remote attackers to view or execute local files within the context of the webserver process. An attacker may leverage the cross-site scripting and HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, render how the site is displayed, or to launch other attacks. SyndeoCMS version 2.8.02 and prior are vulnerable.

• http://www.syndeocms.org/
• https://www.securityfocus.com/bid/42978

---

Updated on 2015-03-25