CVE-2015-5520

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Orchard CMS 1.7.3/1.8.2/1.9.0 - Persistent Cross-Site Scripting2015-07-08 · webapps · asp

Impact

Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://docs.orchardproject.net/Documentation/Patch-20150630
• http://packetstormsecurity.com/files/132583/Orchard-CMS-1.9.0-1.8.2-1.7.3-Cross-Site-Scripting.html
• http://seclists.org/fulldisclosure/2015/Jul/32
• https://projectzero.gr/en/2015/07/orchard-persistent-xss-vulnerability/
• https://www.exploit-db.com/exploits/37533/
• http://docs.orchardproject.net/Documentation/Patch-20150630
• http://packetstormsecurity.com/files/132583/Orchard-CMS-1.9.0-1.8.2-1.7.3-Cross-Site-Scripting.html
• http://seclists.org/fulldisclosure/2015/Jul/32
• https://projectzero.gr/en/2015/07/orchard-persistent-xss-vulnerability/
• https://www.exploit-db.com/exploits/37533/