CVE-2012-2331
CVE-2012-2331
Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the serendipity[textarea] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).
Affected products
n/a · n/apublic PoCs found — 1
exploitdbwww.exploit-db.com/exploits/18884unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://archives.neohapsis.com/archives/bugtraq/2012-05/0037.htmlhttp://blog.s9y.org/archives/240-Serendipity-1.6.1-released.htmlhttp://secunia.com/advisories/49009https://github.com/s9y/Serendipity/commit/264bf55719baacc069ff9d3cc35f0c349cde11e3http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-001.txthttp://www.openwall.com/lists/oss-security/2012/05/08/6http://www.openwall.com/lists/oss-security/2012/05/09/2http://www.rul3z.de/index.php?/214-KORAMISADV2012-001-Serendipity-1.6-Backend-Cross-Site-Scripting-and-SQL-Injection-vulnerability.htmlhttp://www.securityfocus.com/bid/53418