WUZHI CMS 4.1.0 index.php?m=feedback&f=index&v=contact form[content] Persistent cross site scripting

Summaryinfo

A vulnerability identified as problematic has been detected in WUZHI CMS 4.1.0. Impacted is an unknown function of the file index.php?m=feedback&f=index&v=contact. Performing a manipulation of the argument form[content] as part of Parameter results in cross site scripting (Persistent). This vulnerability is identified as CVE-2018-14513. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in WUZHI CMS 4.1.0 (Content Management System). This affects some unknown functionality of the file index.php?m=feedback&f=index&v=contact. The manipulation of the argument form[content] as part of a Parameter leads to a cross site scripting vulnerability (Persistent). CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[content] parameter to the index.php?m=feedback&f=index&v=contact URI.

The bug was discovered 07/20/2018. The weakness was released 07/23/2018 (Website). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2018-14513 since 07/22/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-122063 and VDB-122060. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Vendor

• WUZHI

Name

• CMS

Version

• 4.1.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion