Published: 28/12/2012 Updated: 28/12/2012

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 445

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Open Constructor 3.12.0 allow remote malicious users to inject arbitrary web script or HTML via (1) the result parameter to data/file/edit.php, (2) the q parameter to confirm.php, or (3) the keyword parameter to users/users.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openconstructor project openconstructor 3.12.0

Openconstructor CMS version 3120 suffers from multiple reflective cross site scripting vulnerabilities ...

source: wwwsecurityfocuscom/bid/54822/info Open Constructor is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal cookie-based authentication credentials, compromise the applicati ...

source: wwwsecurityfocuscom/bid/54822/info Open Constructor is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal cookie-based authentication credentials, compromise the application ...

source: wwwsecurityfocuscom/bid/54822/info Open Constructor is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal cookie-based authentication credentials, compromise the application, ...

CWE-79 http://packetstormsecurity.org/files/115284/Openconstructor-CMS-3.12.0-Reflected-XSS.html https://nvd.nist.gov https://packetstormsecurity.com/files/115284/Openconstructor-CMS-3.12.0-Reflected-XSS.html https://www.exploit-db.com/exploits/37580/

CVE-2012-3872

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect