SilverStripe ‘MemberLoginForm.php’信息泄露漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1121788 漏洞类型 输入验证
发布时间 2013-08-01 更新时间 2013-08-01
CVE编号 CVE-2013-2653 CNNVD-ID CNNVD-201308-032
漏洞平台 PHP CVSS评分 5.8
|漏洞来源
https://www.exploit-db.com/exploits/38689
https://www.securityfocus.com/bid/61578
https://cxsecurity.com/issue/WLB-2013080024
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201308-032
|漏洞详情
SilverStripeCMS是新西兰SilverStripe公司的一套开源的编程框架和内容管理系统(CMS)。该系统具有支持多国语言、跨平台等特点。SilverStripe3.0.3版本中的security/MemberLoginForm.php脚本中存在安全漏洞,该漏洞源于程序支持登录使用GET请求。远程攻击者可利用该漏洞实施钓鱼攻击。
|漏洞EXP
source: http://www.securityfocus.com/bid/61578/info

SilverStripe is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.

SilverStripe 3.0.3 is vulnerable; other versions may also be affected. 

http://<X.X.X.X:Port>/Security/LoginForm?AuthenticationMethod=MemberAuthenticator&Email=<email>&Password=<password>&BackURL=%2Fadmin%2Fpages&action_dologin=Log+in
|受影响的产品
SilverStripe SilverStripe 3.0.3
|参考资料

来源:github.com
链接:https://github.com/chillu/silverstripe-framework/commit/3e88c98ca513880e2b43ed7f27ade17fef5d9170
来源:BUGTRAQ
名称:20130801SilverStripe(R)InformationExposureThroughQueryStringsinGETRequest(CWE-598)
链接:http://seclists.org/bugtraq/2013/Aug/12
来源:BID
名称:61578
链接:http://www.securityfocus.com/bid/61578