XSS Vulnerability in Anchor CMS Affects Comments Functionality
CVE-2013-5099

Currently unrated

Key Information:

Vendor

Anchor

Status
Anchor Cms
Vendor
CVE Published:
9 August 2013

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2013-5099?

A cross-site scripting (XSS) vulnerability exists in the article.php file of Anchor CMS version 0.9.1, specifically when comments are enabled. This security flaw allows remote attackers to inject arbitrary web scripts or HTML through manipulation of the Name field. While there have been reports suggesting that comments.php might also be vulnerable, it is essential to note that certain functions from comments.php are utilized by article.php, making the latter the primary vector for exploitation.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2013-5099 - Proof of Concept

References

http://www.securityfocus.com/bid/61376
vdb-entryx_refsource_BID
http://www.exploit-db.com/exploits/26958
exploitx_refsource_EXPLOIT-DB
https://exchange.xforce.ibmcloud.com/vulnerabilities/85888
vdb-entryx_refsource_XF

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.