Join our subscribers
Multiple Vulnerabilities in Ecomat CMS
| Advisory ID: | HTB22390 |
| Product: | Ecomat CMS |
| Vendor: | Codefabrik GmbH |
| Vulnerable Versions: | 5.0 and probably prior |
| Tested Version: | 5.0 |
| Advisory Publication: | May 18, 2010 [without technical details] |
| Vendor Notification: | May 18, 2010 |
| Public Disclosure: | June 1, 2010 |
| Vulnerability Type: | Cross-Site Scripting [CWE-79] SQL Injection [CWE-89] |
| CVE References: | CVE-2010-5030 CVE-2010-5029 |
| Risk Level: | High |
 | |
| CVSSv2 Base Scores: | 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in Ecomat CMS which could be exploited to perform cross-site scripting attacks and execute arbitrary SQL commands in application`s database. | |
| Solution: | |
| Currently we are not aware of any vendor-supplied patches or other solutions. The vendor was contacted in accordance to our Vendor Notification Policy but we didn't get any answer or feedback. | |
References: | |
| [1] High-Tech Bridge Advisory HTB22390 - https://www.immuniweb.com/advisory/HTB22390 - Multiple Vulnerabilities in Ecomat CMS [2] Ecomat CMS - www.codefabrik.ch - Ecomat CMS is a PHP-based content management application. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
