elka CMS跨站脚本攻击漏洞

https://www.exploit-db.com/exploits/34616
https://www.securityfocus.com/bid/43131
https://cxsecurity.com/issue/WLB-2009080048
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200908-335

elkaCMS(又称Elkapax)中的搜索特性存在跨站脚本攻击漏洞。远程攻击者可以借助到默认的URI的Q参数，注入任意的web脚本或HTML。

source: http://www.securityfocus.com/bid/43131/info

Elkagroup Elkapax is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/?q=<script>alert(123)</script>&mode=2

Elkagroup Elkapax 0

来源:XF
名称:tgscms-index-sql-injection(52468)
链接:http://xforce.iss.net/xforce/xfdb/52468
来源:MILW0RM
名称:9434
链接:http://www.milw0rm.com/exploits/9434