https://www.exploit-db.com/exploits/21753
https://www.securityfocus.com/bid/82893
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200306-005

OmniHTTPD是一款适用在MicrosoftWindows操作系统上的WEB服务器程序，OmniHTTPD支持多个CGI扩展来提供动态内容。OmniHTTPD中包含的多个示例程序对用户提供的输入缺少正确检查，远程攻击者可以利用这个漏洞进行跨站脚本执行攻击。OmniHTTPD系统包含的test.php和test.shtml脚本代码对用户输入缺少过滤，攻击者可以构建包含恶意代码的test.php或者test.shtml请求，当其他用户查看链接时，恶意代码就会在用户浏览器中执行，导致基于认证的Cookie信息泄露给攻击者。

source: http://www.securityfocus.com/bid/5568/info

Cross site scripting vulnerabilities have been reported in multiple sample scripts including with OmniHTTPD. In particular, test.shtml and test.php contain errors.

This type of vulnerability may be used to steal cookies or perform other web-based attacks. 

http://localhost/test.php?%3CSCRIPT%3Ealert%28document.URL%29%3C%2FSCRIPT%3E=x

Omnicron OmniHTTPD 0

来源:BUGTRAQ
名称:20020825MoreOmniHTTPdProblems
链接:http://archives.neohapsis.com/archives/bugtraq/2002-08/0266.html
来源:BUGTRAQ
名称:20020825OmniHTTPdtest.shtmlCross-SiteScriptingIssue
链接:http://archives.neohapsis.com/archives/bugtraq/2002-08/0264.html
来源:BUGTRAQ
名称:20020825OmniHTTPdtest.phpCross-SiteScriptingIssue
链接:http://archives.neohapsis.com/archives/bugtraq/2002-08/0263.html