|
Description
|
|
High-Tech Bridge has discovered two vulnerabilities in Twilight CMS, which can be exploited by malicious people to conduct cross-site scripting attacks and disclose certain sensitive information.
1) Input appended to the URL after /gallery/ is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) Input passed via the URL to the application is not properly validated before being used to read files. This can be exploited to disclose contents of arbitrary files.
The vulnerabilities are confirmed in version 5.17 of Russian and English versions. Other versions may also be affected.
|
