Vulnerability Details CVE-2015-1603
Multiple cross-site scripting (XSS) vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to index.php or (2) id parameter in a users_users action to asys/site/system.php.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 72.0%
CVSS Severity
CVSS v2 Score 4.3
References
- http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html
- http://seclists.org/fulldisclosure/2015/Feb/50
- http://sroesemann.blogspot.de/2015/01/sroeadv-2015-14.html
- http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html
- http://www.openwall.com/lists/oss-security/2015/02/13/11
- http://www.openwall.com/lists/oss-security/2015/02/14/1
- http://www.openwall.com/lists/oss-security/2015/02/14/5
- http://www.securityfocus.com/bid/72605
- https://github.com/kneecht/adminsystems/issues/1
- https://github.com/kneecht/adminsystems/releases/tag/4.0.2
- http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html
- http://seclists.org/fulldisclosure/2015/Feb/50
- http://sroesemann.blogspot.de/2015/01/sroeadv-2015-14.html
- http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html
- http://www.openwall.com/lists/oss-security/2015/02/13/11
- http://www.openwall.com/lists/oss-security/2015/02/14/1
- http://www.openwall.com/lists/oss-security/2015/02/14/5
- http://www.securityfocus.com/bid/72605
- https://github.com/kneecht/adminsystems/issues/1
- https://github.com/kneecht/adminsystems/releases/tag/4.0.2
Products affected by CVE-2015-1603
-
cpe:2.3:a:adminsystems_cms_project:adminsystems_cms:4.0.0