Hello 3APA3A!
Earlier I wrote about SQL Injection vulnerability and these are new holes in Soltech.CMS.
There are Cross-Site Scripting and Content Spoofing vulnerabilities in Soltech.CMS. This is commercial CMS.
Vulnerable are Soltech.CMS v 0.4 and previous versions.
Soltech
http://soltech.com.ua
Vulnerable version JW Player 4.2.90 is used in the system.
Cross-Site Scripting (WASC-08):
Content Spoofing (WASC-12):
http://site/plugins/flashplayer/player.swf?file=1.flv&image=1.jpg
http://site/plugins/flashplayer/player.swf?config=1.xml
http://site/plugins/flashplayer/player.swf?abouttext=Player&aboutlink=http://websecurity.com.ua
2013.06.07 - informed developers about the first part of vulnerabilities.
2013.07.13 - announced at my site.
2013.07.14 - informed developers about the second part of vulnerabilities.
2013.08.27 - disclosed at my site (http://websecurity.com.ua/6653/).
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua