Subrion CMS vulnerabilities

There are CSRF vulnerabilities in Subrion CMS versions 4.1.x through 4.1.5 and before 4.2.0 due to a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing attacks against the query parameter to the panel/database.

Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any tag and optionally inject XSS via the tags parameter.

Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blocks/add/ module that allows an attacker to create any blocks. Additionally, the attacker can optionally inject XSS via the content parameter.

Subrion CMS version 4.0.5 has a CSRF vulnerability in the language editing module. An attacker can perform any Edit Language action and optionally inject XSS via the title parameter.

Subrion CMS version 4.0.5.10 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any blog entry and optionally inject XSS via the body parameter.

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.

Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.

Subrion CMS version 4.0.5.10 has an SQL injection vulnerability in the admin/database module via the query parameter.

In Subrion CMS version 4.0.5, a vulnerability allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.

A vulnerability was found in Intelliants Subrion CMS up to version 4.2.1 in the iaUsers::authorize function. Manipulation of the $_SERVER['HTTP_REFERER'] argument causes open redirect. The attack can be performed remotely and the exploit has been made public.

A vulnerability was found in Intelliants Subrion CMS up to version 4.2.1 in the file /actions.json?action=assign-owner. Manipulation of the q argument leads to information disclosure. The attack can be executed remotely and the exploit has been released.

Path traversal vulnerability in Intelliants Subrion CMS through 4.2.1. Authenticated administrators can delete arbitrary files on the server via the admin panel file deletion endpoint, which passes a user-supplied file path directly to unlink() without sanitization.

Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array, which is then placed into %s with only backtick-quoting and no escaping.

Vulnerability in Intelliants Subrion CMS up to version 4.0.3. An unknown functionality of the Blocks Endpoint component allows XSS via manipulation of the CSS class name argument. The attack can be performed remotely.

A CSRF vulnerability in Subrion CMS v4.2.1 allows an unauthenticated attacker to send a crafted request to an administrator, resulting in the creation of an arbitrary administrator account.

Multiple Cross Site Scripting (XSS) vulnerabilities were found in the Configuration panel of Intelliants Subrion CMS v4.2.1. This allows an attacker to inject malicious JavaScript code that can be executed in the administrator's browser.

A Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template. An attacker can inject malicious JavaScript code that executes in the victim's browser.