CVE-2018-12095

MEDIUMNuclei

OEcms 3.1 - Cross-Site Scripting

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2018-12095 has a selected CVSS score of 5.4 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBOEcms 3.1 - Cross-Site ScriptingExploitDB exploitby RenziNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMOEcms 3.1 - Cross-Site ScriptingCVSS 5.4

OEcms 3.1 is vulnerable to reflected cross-site scripting via the mod parameter of info.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Apply the latest patch or upgrade to a newer version of OEcms to fix the XSS vulnerability.

WeaknessesCWE-79
AuthorsLogicalHunter
Template tagscve2018cvexssedboecms_projectvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:oecms_project:oecms:3.1:*:*:*:*:*:*:*
https://www.exploit-db.com/exploits/44895 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12095 https://cxsecurity.com/issue/WLB-2018060092 https://nvd.nist.gov/vuln/detail/CVE-2018-12095 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3