Routing TX script insertion Vulnerability (CVE-2014-0341)

Release date:
Updated on:

Affected Systems:
Optional TX ready TX <2.3.9
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2014-0341
 
Parse Tx is an open-source Blog CMS written in PHP. It uses MySQL or flat files as its database.
 
In versions earlier than ipvtx 2.3.9, there are multiple cross-site scripting vulnerabilities that allow authenticated remote users to pass the templates_internal/pages. tpl, templates_internal/home. tpl, templates_internal/entries. tpl title field, objects. php event field, pages. the php email or nickname field can be exploited to inject arbitrary Web scripts or HTML.
 
<* Source: Diego García

Link: http://secunia.com/advisories/57899/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
PivotX
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released
Http://pivotx.net/page/security