packetstormsecurity.com
http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.html CVE-2014-9148
CRITICAL
Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
Record summary
CVE-2014-9148 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit.
Description
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator function via the view parameter in a direct request to fiyo/dapur.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBFiyo CMS 2.0.1.8 - Multiple VulnerabilitiesExploitDB exploitby MahendraNot analyzed1 file
References
473437vdb entry
http://www.securityfocus.com/bid/73437 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2014-9148 36581exploit
https://www.exploit-db.com/exploits/36581