Yab Quarx 2.4.3 Cross Site Scripting

2018.02.21

Credit: Preethi Koroth

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2018-7274

CWE: CWE-79

Ogólna skala CVSS: 4.3/10

Znaczenie: 2.9/10

Łatwość wykorzystania: 8.6/10

Wymagany dostęp: Zdalny

Złożoność ataku: Średnia

Autoryzacja: Nie wymagana

Wpływ na poufność: Brak

Wpływ na integralność: Częściowy

Wpływ na dostępność: Brak

1. Introduction

Vendor                  :  Yab
Affected Product        : Quarx through 2.4.3 
Fixed in                : Quarx 2.4.5 and 2.4.6
Vendor Website          : https://quarxcms.com/
Vulnerability Type      : Persistent XSS
Remote Exploitable      : Yes
CVE External Identifier : CVE-2018-7274 


2. Technical Description

There are multiple Persistent XSS vulnerabilities in Quarx Content Management System. These vulnerabilities exists 
due to insufficient sanitization of user-supplied data. 


3. Affected pages and parameters:

Blog -> 'Title'
FAQ -> 'Question'
Pages -> 'Title'
Widgets -> 'Name'
Menus -> 'Name'

5. Credit

Preethi Koroth (@p3core0ath)

6. Reference:
https://github.com/YABhq/Quarx/issues/115

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Yab Quarx 2.4.3 Cross Site Scripting

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.