PassMasterFlex (and PassMasterFlex+) XSS injection

2006.05.13
Credit: Nomenumbra
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


Ogólna skala CVSS: 5.8/10
Znaczenie: 4.9/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

PassMasterFlex (and PassMasterFlex+) XSS injection Discovered by: Nomenumbra Date: 5/4/2006 impact:moderate (privilege escalation,possible defacement) PassMasterFlex(+) is a database-driven multiple login that utilizes cookies for authentication. PassMasterFlex+ was written not only to provide an alternative to the Apache login but in response to numerous requests to have multiple users. PMF doesn't filter any data in the user's profiles, thus allowing them to embed any XSS code there to elevate their privileges. Also upon failed login attempt, data gets written to the "hack-log" but without filtering. It is possible to embed XSS in a custom user-agent to obtain cookies. Nomenumbra/[0x4F4C]


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top