CVE-2015-1373
ferretCMS 1.0.4-alpha - Cross-Site Scripting via Action Parameter or Username
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2015-1373.
AI-analyzed exploit summary This advisory details multiple vulnerabilities in ferretCMS v1.0.4-alpha, including stored/reflected XSS, SQL injection, and arbitrary file upload vulnerabilities. It provides specific URLs and payloads for exploitation but does not include functional exploit code.
Description
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter in a search request, (2) username in a login request, which is not properly handled when logging the event, or (3) page title in an insert action.
Exploits (1)
This advisory details multiple vulnerabilities in ferretCMS v1.0.4-alpha, including stored/reflected XSS, SQL injection, and arbitrary file upload vulnerabilities. It provides specific URLs and payloads for exploitation but does not include functional exploit code.