Wuzly 2.0 Username cross site scripting

Summaryinfo

A vulnerability classified as problematic was found in Wuzly 2.0. This impacts an unknown function. Executing a manipulation of the argument Username can lead to cross site scripting. The identification of this vulnerability is CVE-2011-3835. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Wuzly 2.0. It has been declared as problematic. This vulnerability affects an unknown function. The manipulation of the argument username with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

Multiple cross-site scripting (XSS) vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to (1) admin/login.php and (2) admin/404.php; the (3) q parameter to search.php; the (4) theme_name parameter to theme_settings.php, (5) extension_name parameter to extension_settings.php, (6) q parameter to search.php, (7) type parameter to comments.php, sort parameter to (8) pages.php and (9) posts.php, and the (10) type and (11) q parameter to media.php in admin/; the sidebar parameter to (12) add_widget.php and (13) widgets.php, id parameter to (14) category_delete.php, (15) comment.php, (16) page_delete.php, and (17) post_delete.php, (18) type parameter to media.php, and (19) id and (20) sidebar parameter to widget_delete.php in mobile/; and the (21) name, (22) email, (23) website, and (24) comment parameters to index.php; and the (25) username parameter to admin/login.php.

The weakness was shared 12/24/2011 (Website). The advisory is available at osvdb.org. This vulnerability was named CVE-2011-3835 since 09/26/2011. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (71906), OSVDB (77914†) and Secunia (SA46163†). The entries VDB-59798, VDB-59797, VDB-59796 and VDB-59795 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Wuzly

Version

• 2.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion