OSVDB ID: 81561 Title: DiY-CMS poll/add.php URI XSS |
Info |
|
|
Dates |
||||
|
|
Description |
DiY-CMS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input passed via the url upon submission to the poll/add.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Solution: Third-Party Solution Exploit: Exploit Public Disclosure: Uncoordinated Disclosure OSVDB: Web Related |
Solution |
Currently, there are no known workarounds or vendor upgrades to correct this issue. However, snup of Vulnerability Labs has released an unofficial patch to address this vulnerability. As with all third-party solutions, ensure they come from a reliable source and are permitted under your company's security policy. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |