medium4.8Public exploit code
CVE-2018-11512
Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- wityCMS 0.6.1 - Cross-Site Scripting2018-05-28 · webapps · php
Impact
Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Creatiwity | Witycms | Version 0.6.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Creatiwity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44
- https://github.com/Creatiwity/wityCMS/issues/150
- https://www.exploit-db.com/exploits/44790/
- https://github.com/Creatiwity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44
- https://github.com/Creatiwity/wityCMS/issues/150
- https://www.exploit-db.com/exploits/44790/