Saurus
Monthly
SQL injection in Saurus CMS Community Edition's admin panel grants authenticated administrators the ability to fully enumerate and extract data from the underlying database. The flaw resides in admin/db_data.php at line 509, where the table_name GET or POST parameter is passed unsanitized into a SHOW COLUMNS FROM SQL statement, enabling time-based blind, boolean-based blind, and error-based injection techniques that expose the full schema and can be chained to extract credential data. A publicly available proof-of-concept exploit has been published by VulnCheck; no patch has been identified at time of analysis.
Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to admin/user_management.php, (2). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
SQL injection in Saurus CMS Community Edition's admin panel grants authenticated administrators the ability to fully enumerate and extract data from the underlying database. The flaw resides in admin/db_data.php at line 509, where the table_name GET or POST parameter is passed unsanitized into a SHOW COLUMNS FROM SQL statement, enabling time-based blind, boolean-based blind, and error-based injection techniques that expose the full schema and can be chained to extract credential data. A publicly available proof-of-concept exploit has been published by VulnCheck; no patch has been identified at time of analysis.
Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to admin/user_management.php, (2). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.