*CVE-2014-9562 OptimalSite Content Management System (CMS) XSS (Cross-Site
Scripting) Security Vulnerabilities*





Exploit Title:  OptimalSite CMS /display_dialog.php image Parameter XSS
Security Vulnerability
Vendor: OptimalSite
Product: OptimalSite Content Management System (CMS)
Vulnerable Versions: V.1 V2.4
Tested Version: V.1 V2.4
Advisory Publication: Feb 2, 2015
Latest Update: Feb 2, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-9562
CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU),
Singapore]








*Advisory Details:*

*(1) Vendor & Product Description*

*Vendor:*
OptimalSite


*Product & Version:*
OptimalSite Content Management System (CMS)
V.1
V2.4


*Vendor URL & Download:*
http://www.optimalsite.com/en/



*Product Description:*
“Content management system OptimalSite is an online software package that
enables the management of information published on a website.”

“OptimalSite consists of the system core and integrated modules, which
allow expanding website possibilities and functionality. You may select a
set of modules that suits your needs best.”





*(2) Vulnerability Details:*
OptimalSite Content Management System (CMS) has a security problem. It can
be exploited by XSS attacks.

*(2.1) *The vulnerability occurs at “display_dialog.php” page with “image”
parameter.







*References:*
http://tetraph.com/security/cves/cve-2014-9562-optimalsite-content-management-system-cms-xss-cross-site-scripting-security-vulnerabilities/
http://securityrelated.blogspot.com/2015/02/cve-2014-9562-optimalsite-content.html
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9562
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9562
https://security-tracker.debian.org/tracker/CVE-2014-9562
http://www.cvedetails.com/cve/CVE-2014-9562/
http://www.security-database.com/detail.php?alert=CVE-2014-9562
http://packetstormsecurity.com/files/cve/CVE-2014-9562
http://www.pentest.it/cve-2014-9562.html
http://www.naked-security.com/cve/CVE-2014-9562/
http://007software.net/cve-2014-9562/
https://security-tracker.debian.org/tracker/CVE-2014-9562








--
Wang Jing,
Division of Mathematical Sciences (MAS),
School of Physical and Mathematical Sciences (SPMS),
Nanyang Technological University (NTU),
Singapore.
http://www.tetraph.com/wangjing/