ID de Prueba:	1.3.6.1.4.1.25623.1.0.800773
Categoría:	Web application abuses
Título:	Zikula Multiple XSS and CSRF Vulnerabilities
Resumen:	Zikula is prone to multiple cross-site scripting and cross-site request forgery vulnerabilities.
Descripción:	Summary: Zikula is prone to multiple cross-site scripting and cross-site request forgery vulnerabilities. Vulnerability Insight: - Input passed to the 'lang' parameter and to the 'func' parameter in the 'index.php' is not properly sanitised before being returned to the user. - Failure in the 'users' module to properly verify the source of HTTP request. - Error in 'authid protection' mechanism for lostpassword form and mailpasswd processing, which makes it easier for remote attackers to generate a flood of password requests. Vulnerability Impact: Successful exploitation will allow remote attackers to compromise the application, disclosure or modification of sensitive data, execute arbitrary HTML and script and conduct cross-site request forgery (CSRF) attacks. Affected Software/OS: Zikula version prior to 1.2.3 Solution: Upgrade to the Zikula version 1.2.3 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2010-1732 http://www.htbridge.ch/advisory/xsrf_csrf_in_zikula_application_framework.html Common Vulnerability Exposure (CVE) ID: CVE-2010-1724 BugTraq ID: 39717 http://www.securityfocus.com/bid/39717 Bugtraq: 20100427 XSS vulnerability in Zikula Application Framework (Google Search) http://www.securityfocus.com/archive/1/510988/100/0/threaded http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework.html http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework_1.html http://www.osvdb.org/64095 http://osvdb.org/64096 http://secunia.com/advisories/39614 XForce ISS Database: zikula-index-xss(58224) https://exchange.xforce.ibmcloud.com/vulnerabilities/58224 Common Vulnerability Exposure (CVE) ID: CVE-2010-4729
Copyright	Copyright (C) 2010 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.