Description
Multiple cross-site scripting (XSS) vulnerabilities in Arif Supriyanto auraCMS 1.62 allow remote attackers to inject arbitrary web script or HTML via (1) the judul_artikel parameter in teman.php and (2) the title of an article sent to admin, which is displayed when unauthenticated users visit index.php.
References
- auracms-teman-xss(27703) vdb-entry
- http://h1.ripway.com/lintah/adv/txt/01-iFX-2006-AuraCMS-v1.62-XSS-Bug.txt
- 28202 vdb-entry
- 28200 vdb-entry
- auracms-title-xss(27704) vdb-entry
- 1226 third-party-advisory
- 18867 vdb-entry
- 20060706 lintah_|adv|_01@2006>=========<[Aura-CMS v1.62]>===<[XSS vulnerable]&[bug] mailing-list