Info

Disclosure

Jul 29, 2005

Discovery

Jul 26, 2005

Dates

Exploit

Jul 29, 2005

Solution

Unknown

Description

Easy PX 41 CMS contains a flaw that may allow an attacker to inject or manipulate variables in various scripts. This flaw exists because the application does not validate many variables in various scripts. This could allow a user to create a specially crafted URL that would give access to webpage contents without the need to authenticate or to execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity and confidentiality.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Available
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

Easy PX 41

Easy PX 41 CMS

v05.05.06

References

Secunia Advisory ID: 16264
Related OSVDB ID: 18333 18335 18336
Other Advisory URL: http://falcondeoro.blogspot.com/2005/07/xss-flaws-and-data-disclosure-in.html
Vendor URL: http://www.easypx41.be/

Credit

FalconDeOro - falcondeorogmail.com - Personal Page

Direct URL: http://osvdb.org/36218