Centrinity FirstClass HTTP Server 5/7 – ‘TargetName’ Cross-Site Scripting

Centrinity FirstClass HTTP Server 5/7 – ‘TargetName’ Cross-Site Scripting

漏洞ID 1054419 漏洞类型
发布时间 2004-03-22 更新时间 2004-03-22
图片[1]-Centrinity FirstClass HTTP Server 5/7 – ‘TargetName’ Cross-Site Scripting-安全小百科CVE编号 N/A
图片[2]-Centrinity FirstClass HTTP Server 5/7 – ‘TargetName’ Cross-Site Scripting-安全小百科CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/23871
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/9950/info

It has been reported that FirstClass HTTP Server may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute arbitrary HTML or script code in a user's browser. The issue presents itself due to insufficient sanitization of user-supplied data via the 'TargetName' parameter of 'Upload.shtml' script.

Since this vulnerability affects the web server there is a possibility of an attacker crossing domains if multiple domains are hosted on one web server. The vendor has reported that this vulnerability only affects the 'standard' template set. The 'webmail' and 'mobile' template sets do not contain the 'Upload.shtml' script.

Centrinity FirstClass versions 7.1 and prior may be vulnerable to this issue.

http://www.example.com/.Templates/Commands/Upload.shtml?TargetName=<script>alert('XSS')</script>

相关推荐: Multiple PHPGroupWare HTML Injection Vulnerabilities

Multiple PHPGroupWare HTML Injection Vulnerabilities 漏洞ID 1099974 漏洞类型 Input Validation Error 发布时间 2003-07-02 更新时间 2003-07-02 CVE编…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享