• info
• discussion
• exploit
• solution
• references

ContentNow Multiple Remote Vulnerabilities

ContentNow is prone to multiple cross-site scripting vulnerabilities and an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The attacker can exploit the file-upload issue to execute arbitrary code in the context of the webserver.

ContentNow 1.4.1 is vulnerable; prior versions may also be affected.