_:n03e2a06bfa9e4b17a289323c12b91f10xb0
<http://schema.org/description>
"-=[--------------------ADVISORY-------------------]=-                     Drake CMS V. 0.2            Author: CorryL    x0n3-h4ck.org  -=[----------------------------------------------------]=- -=[+] Application:    Drake CMS -=[+] Version:        0.2 -=[+] Vendor&amp;#x27;s URL:   https://sourceforge.net/projects/drakecms/ -=[+] Platform:       WindowsLinuxUnix -=[+] Bug type:       XSS,Full Patch Diclouse -=[+] Exploitation:   Remote/Local -=[-] -=[+] Author:         CorryL  ~ corryl80[at]gmail[dot]com ~ -=[+] Reference:      www.x0n3-h4ck.org -=[+] Virtual Office: http://www.kasamba.com/CorryL ..::[ Descriprion ]::.. Drake CMS is a dynamic web authoring and content managment system; it can be installed in a few minutes, almost all databases are supported plus an embedded flat file database. Its top features are security, speed, easy management and high customization. ..::[ Bug ]::.. This CMS is affection from a bug type Cross-site script (RSS) and   a full patch diclouse, a remote attacker is able to exploit these vulnerability to draw sensitive information. ..::[ Proof Of Concept ]::.. 1°) Cross-Site script (xss) Bug on /index.php?option=contact&amp;amp;Itemid=10&amp;amp;task=category&amp;amp;id=&amp;lt;ScRiPt%20%0a%0d&amp;gt;alert(764606807)%3B&amp;lt;/ScRiPt&amp;gt; 2°) Full path diclouse on /classes/simplecaptcha/captcha.png.php ..::[ Workaround ]::.. https://sourceforge.net/projects/drakecms/ ..::[ Disclousure Timeline ]::.. [01/11/2006] - Vendor notification [01/11/2006] - Vendor Response [04/11/2006] - Public disclousure  Alice BASIC: mail, antivirus, antispam e invio allegati fino a 2 GB! Per maggiori informazioni vai su:..."
<https://vulners.com/securityvulns/SECURITYVULNS:DOC:14931>