Multiple cross-site scripting (XSS) vulnerabilities in Ripe Website Manager 0.8.9 and previous versions allow remote authenticated users to inject arbitrary web script or HTML via one or more of the following vectors: the (1) id parameter to (a) pages/delete_page.php, (b) navigation/delete_menu.php, and (c) navigation/delete_item.php in admin/; the (2) menu_id, (3) name, (3) page_id, and (4) url parameters in (d) admin/navigation/do_new_item.php; the (5) new_menuname parameter in (e) admin/navigation/do_new_nav.php; and (6) area1, name, and url parameters to (f) admin/pages/do_new_page.php, probably involving the Title or textarea field as reachable through admin/pages/new_page.php. NOTE: the original disclosure does not precisely state which vectors are associated with SQL injection versus XSS.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
ripe website manager ripe website manager 0.8.4 |
||
ripe website manager ripe website manager 0.8.9 |
Vulmon