Questions tagged [cms]

A Content Management System (CMS) is a platform used to build websites that are easily edited by multiple users.

Filter by
Sorted by
Tagged with
6
votes
2answers
651 views

How to ensure that our production environment deployment process is PCI-compliant when we need to perform live code updates?

In planning the next phase of our platform, I am trying to ensure that the production deployment process is PCI compliant. We have a central platform which acts as a CMS, serving custom content based ...
5
votes
1answer
4k views

Using client certificates for website authentication

I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
4
votes
3answers
2k views

Techniques for fingerprinting a web based content management system (CMS)

Let's say we have a random basic blog or informational website: just some pages with information, a sidebar with an overview of the archives, the normal stuff. We know of this website that it's built ...
4
votes
1answer
1k views

Root server hacked via httpd - consequences and future prevention

Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started investigating....
4
votes
2answers
277 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
4
votes
1answer
80 views

Potential risks of a single codebase for multiple CMSes

We are currently in the process of converting our multiple codebases (which are exactly the same, except for a configuration file and 2 stylesheets). We have been thinking about this for a while, and ...
4
votes
0answers
101 views

Detect malicious content on enourmous multi-site CMS [closed]

My Goal: My hope is to catch pages and content that would be flagged by Google Safe Browsing or others like it, except more proactive than waiting for a crawl by Google or being added to a ...
3
votes
1answer
163 views

How to protect a website from DDoS without a CDN? [closed]

I have basic knowledge in Bash and with that knowledge I rented a remote machine in a mostly-self-managed hosting platform (DigitalOcean) and raised a LEMP environment on which I have a website. I ...
2
votes
2answers
61 views

does vBulletin and similar discussion forum CMS store previous email address and password hash in database?

I am in the process of De-Googling myself and use complex passwords. I change my registered Gmail to an alternative mail provider I change my password to a complex one I use mostly vbulletin and ...
2
votes
1answer
32 views

Can a CMS generated HTML Document from an admin be considered trusted, and not vulnerable to XSS?

Currently, I am working on a CMS/Framework I developed that is similar to Wordpress, in that it is a platform for admins to create/post content for users. I am saving the HTML that is generated by ...
2
votes
3answers
687 views

Where is the most secure location to host an admin panel?

I have an admin panel on my site, that enables me to control the content on my website. In order for the admin panel to achieve this, I must have a connection to the site's database. I have two ...
1
vote
1answer
1k views

Having http site load https content - Approach

My website is an information only website and all the information on it is available to all those who visit the website. There is no sensitive data and no user sessions\logins. The content on my http ...
1
vote
1answer
136 views

Are these the only possible cases for DB injection?

After reading a bit on DB injections (whether SQL, NoSQL, or of any DB querying language whatsoever), I understand that there are only 3 possible cases for this kind of attack to be effective: When ...
1
vote
1answer
389 views

Logout CSRF Protection [duplicate]

I am making a CMS and I have a CSRF protection in settings, new article. Should I also put this protection in the logout ?
1
vote
1answer
58 views

Trying to get a grasp of approximate risk level of CMS admin logins over http

Forgive me for a potentially obvious question--and I know the safe answer is "Always use https!"--but I'm trying to get a grasp on how necessary it is to use https for anyone accessing the backend on ...
1
vote
1answer
640 views

Detecting SMIME type using OpenSSL CMS

Is it possible to detect S/MIME content types (enveloped or signed) using OpenSSL CMS API? I would prefer to avoid pre-parsing S/MIME headers and let OpenSSL to detect whether message is signed or ...
1
vote
0answers
56 views

Magento site hacked by unknown vulnerability [duplicate]

Home page of my Magento site is hacked. A hacker put his javascript and html code in design/head/includes of table core_config_data. Somehow he updated value of design/head/includes from NULL to his ...
1
vote
1answer
114 views

Ghost CMS abnormal access

I have a blog hosted with Ghost CMS. I created a new blog post (say "My New Blog") and correspondingly there was a url generated (mysite.com/mynewblog/) The weird part is that I saw an access to this ...
1
vote
0answers
56 views

How to anonymize contributors while still keeping attribution?

Imagine a CMS with authentication where the author of each article has to be stored in the database. Now I want to make it harder to analyze (by crawling or stealing the database) who has written ...
0
votes
2answers
246 views

Full protection from shell-script injections (like a “Bash injection”) - Is it even possible?

Assume there's a website built with some FOSS CMS (like Drupal) and the websites' directory is owned and grouped by root (instead www-data as common in Apache in Nginx) and a friend of the site's ...
0
votes
2answers
911 views

Prestashop + mod_security concerns

Running a shared hosting service, a client contacted me if I could disable mod_security for their webapp. The thing is, there is this patchwork webshop CMS called Prestashop with some hair-raising ...