XunRuiCMS vulnerabilities

XunRuiCMS (dayrui) through version 4.7.4 has a flaw in the str_replace function in /var/www/html/zzmob/index.php within the Mobile Site Directory component. Manipulation of the dirname argument results in code injection, and the attack can be launched remotely.

A vulnerability in XunruiCMS up to 4.7.2 affects the group_all_edit function in dayrui/App/Member/Controllers/Admin/Home.php of the Group Editing component. Manipulation of the groupid argument causes SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1 in an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile in the Domain Name Binding Page component. The manipulation results in cross site scripting. The attack may be performed remotely and has a high complexity level.

A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1 in some unknown functionality of the file /admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=1 in the Add Data Validation Page component. Manipulation of the data[name] argument leads to cross site scripting. The attack is possible remotely.