Threat database

SiteServer SSCMS versions up to 7.4.0 have an authorization bypass vulnerability in the ChannelsController component. This flaw allows site-scoped administrators with Channels permission on one site to access and modify channels belonging to other sites by supplying foreign channel IDs. The vulnerability breaks multi-site isolation by permitting unauthorized reading and overwriting of channel names, file paths, templates, link URLs, and custom fields across sites.

A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handler. The manipulation of the argument tableHandWrite results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET request to /cms/templates/templatesAssetsEditor.