Multiple vulnerability in jupiter CMS
Author : KaDaL-X
email : king_purba@xxxxxxxxxxx
site : http://kandangjamur.net/
Multiple vulnerability in jupiter CMS
Vendor : http://www.highstrike.net/
version 1.1.5
Vulnerability code found in file modules/online.php
PoC:
XSS
http://xxx/jupiter/jupiter/index.php?n=modules/online&&a=1&language=1&layout=%3Ch1%3E%3Cmarquee%3Ealooo
FIX:
Create a validation function to fix the bugs, you can use htmlspecialchars()
function to fix this security issue
Full Path disclosure
http://xxxx/jupiter/jupiter/modules/online.php
FIX:
Turn off display error
Note :
Sorry, but vendor site is also vuln with this bugs