CVE-2011-4709 Multiple cross-site scripting (XSS) vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject arbitrary web script or HTML via the (1) SITE_NAME parameter....
MediumCVSS 4.3
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject arbitrary web script or HTML via the (1) SITE_NAME parameter to admin_index.php, or the (2) return and (3) search parameters to index.php. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hotaru search plugin | = 1.3 | No fix listed |
| hotaru cms | = 1.4.2 | No fix listed |
References
- 46842 third-party-advisory vendor-advisory
- 77095 vdb-entry
- www.zeroscience.mk
- www.zeroscience.mk exploit
- hotarucms-index-xss(71300) vdb-entry
- hotarucms-hotaru-xss(71301) vdb-entry
- hotaru-hotaru-xss(71302) vdb-entry