白帽子安全

白帽子文章
计算机安全
安全漏洞
网络攻击

© 白帽子安全 | Powered by LOFTER

CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-

CVE-2014-8751  goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

 

 

 

 

 

 

Exploit Title: goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Product: WebPress

Vendor: goYWP

Vulnerable Versions: 13.00.06

Tested Version: 13.00.06

Advisory Publication: Dec 09, 2014

Latest Update: Dec 09, 2014

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8751

Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]

 

 

 

 

 

 

 





 

Advisory Details:

 

(1) Product

“WebPress is the foundation on which we build web sites. It’s our unique Content Management System (CMS), flexible enough for us to build your dream site, and easy enough for you to maintain it yourself.”

 

 

(2) Vulnerability Details:

goYWP WebPress has a security problem. It is vulnerable to XSS attacks.

 

(2.1) The first security vulnerability occurs at “/search.php” page with “&search_param” parameter in HTTP GET.

 

(2.2) The second security vulnerability occurs at “/forms.php” (form submission ) page with “&name”, “&address” “&comment” parameters in HTTP POST.

 

 

 

 

 

 

 

 

 






 

References:

http://seclists.org/fulldisclosure/2014/Dec/34

http://www.cnvd.org.cn/flaw/show/CNVD-2014-09095

http://cxsecurity.com/issue/WLB-2014120057

http://packetstormsecurity.com/files/129443/goYWP-WebPress-13.00.06-Cross-Site-Scripting.html

http://marc.info/?l=full-disclosure&m=141815910228867&w=4

http://tetraph.com/security/cves/cve-2014-8751-goywp-webpress-multiple-xss-cross-site-scripting-security-vulnerabilities/

http://www.scap.org.cn/CVE-2014-8751.html

http://advisories75.rssing.com/chan-6966477/all_p243.html#item4845

http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/xss-vulnerability/cve-2014-8751-goywp-webpress-multiple-xss-cross-site-scripting-security-vulnerabilities/

https://computertechhut.wordpress.com/2014/12/29/cve-2014-8751-goywp-webpress-multiple-xss-cross-site-scripting-security-vulnerabilities/

 

 

 

 

 

 

 

 
评论
热度 ( 4 )