CVE-2010-0997

Related Files

e107 Content Management Plugin Script Insertion

Posted Apr 19, 2010

Site secunia.com

Secunia Research has discovered a vulnerability in e107, which can be exploited by malicious users to conduct script insertion attacks. Input passed via the "content_heading" parameter to 107_plugins/content/content_manager.php while creating new content is not properly sanitized before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Successful exploitation requires authentication and that the Content Management plugin is enabled. e107 version 0.7.19 is affected.

tags | advisory, arbitrary, php

advisories | CVE-2010-0997

SHA-256 | 9e5427a42ec609184b91c787aba776dfd53753bbf2594f58df51f916c1df2df2

Download | Favorite | View