https://www.exploit-db.com/exploits/22000
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-839

从ZeusWebServer4.0到4.1r2版本Zeus管理服务器存在跨站脚本攻击(XSS)漏洞。远程认证用户借助index.fcgi的section参数注入任意web脚本或HTML。

source: http://www.securityfocus.com/bid/6144/info

The Zeus Web Server contains a web based administration interface that is vulnerable to cross site scripting attacks.

Due to insufficient sanitization of user-supplied input it is possible for an attacker to construct a malicious link which contains arbitrary HTML and script code, which will be executed in the web client of a user who visits the malicious link. It should be noted that the user must authenticate with the administrative interface for the attack to succeed.

The vendor has stated that cookies are not used to store usernames and passwords. 

http://hostname:9090/apps/web/index.fcgi?servers=&section=<script>alert(document.cookie)</script>

来源:BID
名称:6144
链接:http://www.securityfocus.com/bid/6144
来源:XF
名称:zeus-admin-index-xss(10567)
链接:http://www.iss.net/security_center/static/10567.php
来源:BUGTRAQ
名称:20021211Re:ZeusAdminServerv4.1r2index.fcgiXSSbug
链接:http://online.securityfocus.com/archive/1/302961
来源:BUGTRAQ
名称:20021108ZeusAdminServerv4.1r2index.fcgiXSSbug
链接:http://archives.neohapsis.com/archives/bugtraq/2002-11/0104.html