CVE-2013-20006
HIGHQool CMS Multiple Persistent Cross-Site Scripting Vulnerabilities
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2013-20006. PoCs published by LiquidWorm.
AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in Qool CMS v2.0 RC2, allowing an attacker to add a root-level user via a crafted HTML form. It also includes multiple XSS injection examples targeting various admin endpoints.
Description
Qool CMS contains multiple persistent cross-site scripting vulnerabilities in several administrative scripts where POST parameters are not properly sanitized before being stored and returned to users. Attackers can inject malicious JavaScript code through parameters like 'title', 'name', 'email', 'username', 'link', and 'task' in endpoints such as addnewtype, addnewdatafield, addmenu, addusergroup, addnewuserfield, adduser, addgeneraldata, and addcontentitem to execute arbitrary scripts in administrator browsers.
Exploits (1)
This exploit demonstrates a CSRF vulnerability in Qool CMS v2.0 RC2, allowing an attacker to add a root-level user via a crafted HTML form. It also includes multiple XSS injection examples targeting various admin endpoints.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N