Siteserver
Monthly
SQL injection in SSCMS v7.4.0 enables high-privileged attackers to execute arbitrary SQL statements via the stl:sqlContent tag's queryString attribute. Attackers with administrative access can craft encrypted payloads to the /api/stl/actions/dynamic endpoint, bypassing parameterization controls to achieve database compromise, authentication bypass, or complete data exfiltration. EPSS data not available; no confirmed active exploitation (CISA KEV negative); public exploit code availability unknown but detailed technical advisory published by VulnCheck increases weaponization risk.
SiteServer SSCMS 7.1.3, 7.2.1 and 7.4.0 do not properly restrict excessive authentication attempts, allowing an unauthenticated remote attacker who manipulates the isForceLogoutAndLogin argument on the admin login submit handler (LoginController.Submit) to sidestep the CAPTCHA / attempt-throttling control and then brute-force administrator credentials. The vendor rates exploitation as difficult (CVSS 4.0 base 6.3, AC:H, confidentiality-only impact), and no public exploit code was identified at time of analysis; the issue is tracked for remediation in the current monthly patch cycle rather than as an emergency. Meaningful impact requires that the admin login interface be network-reachable and that subsequent credential guessing succeed, which would expose the CMS administrative console.
Site-scoped authorization bypass in SiteServer SSCMS through 7.4.0 allows an authenticated administrator who holds Channels permission on one site to read and overwrite another site's channel records by supplying a foreign channel ID to the ChannelsController Get and Update APIs. This CWE-639 IDOR breaks multi-site isolation for channel metadata such as names, file paths, templates, link URLs, and custom fields, but requires privileged tenant-admin access and a multi-site deployment; single-site installations and users without Channels permission are effectively unaffected. The provided CVSS 5.1 (CVSS 4.0) and the independent assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N both indicate a moderate, privilege-gated issue, and no public exploit identified at time of analysis.
Improper access control in SiteServer SSCMS 7.4.0's Agent Installation Workflow allows remote attackers to bypass security restrictions by manipulating the SecurityKey argument, potentially gaining unauthorized access to protected functionality. The CVSS 4.0 score of 2.3 reflects genuine exploitation difficulty - high attack complexity and required passive user interaction significantly limit opportunistic abuse - though the authentication bypass characterization indicates a security boundary violation is achievable under the right conditions. No patch is available; the project has not responded to responsible disclosure submitted via GitHub issue #3898, and no public exploit has been identified at this time.
Reflected cross-site scripting in SSCMS v7.4.0 allows authenticated attackers to inject arbitrary JavaScript through crafted STL template payloads in the /api/stl/actions/dynamic endpoint. The vulnerability arises from improper output encoding when decrypted STL templates are returned in JSON responses, enabling session hijacking, credential theft via phishing, and unauthorized user actions. User interaction is required to trigger the payload, limiting but not eliminating real-world risk.
A issue was discovered in SiteServer CMS 6.9.0. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in SSCMS v7.4.0 enables high-privileged attackers to execute arbitrary SQL statements via the stl:sqlContent tag's queryString attribute. Attackers with administrative access can craft encrypted payloads to the /api/stl/actions/dynamic endpoint, bypassing parameterization controls to achieve database compromise, authentication bypass, or complete data exfiltration. EPSS data not available; no confirmed active exploitation (CISA KEV negative); public exploit code availability unknown but detailed technical advisory published by VulnCheck increases weaponization risk.
SiteServer SSCMS 7.1.3, 7.2.1 and 7.4.0 do not properly restrict excessive authentication attempts, allowing an unauthenticated remote attacker who manipulates the isForceLogoutAndLogin argument on the admin login submit handler (LoginController.Submit) to sidestep the CAPTCHA / attempt-throttling control and then brute-force administrator credentials. The vendor rates exploitation as difficult (CVSS 4.0 base 6.3, AC:H, confidentiality-only impact), and no public exploit code was identified at time of analysis; the issue is tracked for remediation in the current monthly patch cycle rather than as an emergency. Meaningful impact requires that the admin login interface be network-reachable and that subsequent credential guessing succeed, which would expose the CMS administrative console.
Site-scoped authorization bypass in SiteServer SSCMS through 7.4.0 allows an authenticated administrator who holds Channels permission on one site to read and overwrite another site's channel records by supplying a foreign channel ID to the ChannelsController Get and Update APIs. This CWE-639 IDOR breaks multi-site isolation for channel metadata such as names, file paths, templates, link URLs, and custom fields, but requires privileged tenant-admin access and a multi-site deployment; single-site installations and users without Channels permission are effectively unaffected. The provided CVSS 5.1 (CVSS 4.0) and the independent assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N both indicate a moderate, privilege-gated issue, and no public exploit identified at time of analysis.
Improper access control in SiteServer SSCMS 7.4.0's Agent Installation Workflow allows remote attackers to bypass security restrictions by manipulating the SecurityKey argument, potentially gaining unauthorized access to protected functionality. The CVSS 4.0 score of 2.3 reflects genuine exploitation difficulty - high attack complexity and required passive user interaction significantly limit opportunistic abuse - though the authentication bypass characterization indicates a security boundary violation is achievable under the right conditions. No patch is available; the project has not responded to responsible disclosure submitted via GitHub issue #3898, and no public exploit has been identified at this time.
Reflected cross-site scripting in SSCMS v7.4.0 allows authenticated attackers to inject arbitrary JavaScript through crafted STL template payloads in the /api/stl/actions/dynamic endpoint. The vulnerability arises from improper output encoding when decrypted STL templates are returned in JSON responses, enabling session hijacking, credential theft via phishing, and unauthorized user actions. User interaction is required to trigger the payload, limiting but not eliminating real-world risk.
A issue was discovered in SiteServer CMS 6.9.0. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.