Maxwebportal 1.30 – ‘search.asp?Search’ Cross-Site Scripting

Maxwebportal 1.30 – ‘search.asp?Search’ Cross-Site Scripting

漏洞ID 1053942 漏洞类型
发布时间 2003-06-06 更新时间 2003-06-06
图片[1]-Maxwebportal 1.30 – ‘search.asp?Search’ Cross-Site Scripting-安全小百科CVE编号 N/A
图片[2]-Maxwebportal 1.30 – ‘search.asp?Search’ Cross-Site Scripting-安全小百科CNNVD-ID N/A
漏洞平台 ASP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22746
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7837/info

A number of vulnerabilities have been discovered in the MaxWebPortal.

The issues that have been discovered include:

MaxWebPortal 'search.asp' has been reported prone to a cross-site scripting vulnerability. An attacker may execute arbitrary script code in the security context of the system running MaxWebPortal.

MaxWebPortal has been reported prone to insecure hidden form field vulnerability. An attacker may save the 'start new topic' page offline. By modifying certain field values, the attacker may corrupt the MaxWebPortal contents.

MaxWebPortal has also been reported prone to insecure session cookie vulnerability. Reportedly if an attacker can retrieve a session cookie for a legitimate MaxWebPortal user, the attacker may hijack the account.

MaxWebPortal has been reported prone to a database disclosure vulnerability. MaxWebPortal does not sufficiently secure the database file. It is possible for remote attackers to request the database file and gain access to sensitive information.

MaxWebPortal 'password.asp' has been reported prone to a password-reset vulnerability. It has been reported that by requesting a forgotten password, an attacker may save the 'password reset' page offline. By modifying the member id in the script the attacker may reset arbitrary account passwords. 

http://www.example.com/search.asp?Search="><script>alert()</script>

相关推荐: Microsoft Windows 9x / Me Share Level Password Bypass Vulnerability

Microsoft Windows 9x / Me Share Level Password Bypass Vulnerability 漏洞ID 1103773 漏洞类型 Access Validation Error 发布时间 2000-10-10 更新时间…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享