Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users, with certain module privileges, to inject arbitrary web script or HTML via the (1) fullname, (2) address, (3) city, (4) provstate (aka state), (5) phone, or (6) taxid parameter in a stormorganization action to index.php; the (7) name parameter in a stormperson action to index.php; the (8) stepno (aka Step no.) or (9) title parameter in a stormtask action to index.php; the (10) title (aka Project) parameter in a stormticket action to index.php; or (11) unspecified parameters in a stormproject action to index.php. NOTE: some of these details are obtained from third party information.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Speedtech Storm Project HTML注入漏洞
Vulnerability Description
Drupal是很著名的开源内容管理平台，仿照了blog程序模式，但比普通的blog更灵活，可以做各种网站的内容管理平台。 Drupal的Storm模块存在多个跨站脚本攻击漏洞。具有某些模块功能权限的远程认证用户可以通过多个参数注入任意的web脚本和HTML。这些参数包含：脚本index.php的stormorganization功能的参数(1) fullname, (2) address, (3) city, (4) provstate (aka state), (5) phone, 或者 (6) tax
CVSS Information
N/A
Vulnerability Type
N/A