CVE-2015-8667 - Exponent CMS 2.3.5 Multiple Cross Site Scripting
Vulnerabilities


Product : Exponent CMS

CVE : CVE-2015-8667

Author : Sachin Wagh

Affected Version : Exponent CMS  2.3.5

Fixed Version: Exponent CMS  2.3.7

============================================================================
Details:

The Exponent CMS is prone to a multiple cross-site scripting
vulnerabilities
because it fails to sufficiently sanitize user-supplied input submitted to
‘Username/Email’ field of ‘Reset Your Password’ module.

An attacker may leverage this issue to execute arbitrary script code in the
browser of an unsuspecting user in the context of the affected site. This
may allow the attacker to steal cookie-based authentication credentials and
to launch other attacks.

============================================================================

 Affected Area(s):

1.http://localhost/exponent-2.3.5/navigation/edit_contentpage/id/1

Parameter:

sef_name
canonical
page_title

2.http://localhost/exponent-2.3.5/users/edituser/id/1

Parameter:

firstname

3.http://localhost/exponent-2.3.5/users/manage_groups

Parameter:

name
description

============================================================================

Credits & Authors :


Sachin Wagh (@tiger_tigerboy)