VHCS --- Virtual Hosting Control System Cross Site Scripting

2006.05.04

Credit: outlaw aria-security net

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2006-2174

CWE: CWE-79

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

#----------------------------------------------------------

#Aria-Security.net Advisory

#Discovered  by: O.U.T.L.A.W

#< www.Aria-security.net>

#Gr33t to: A.u.r.a  & R@1D3N & Smok3r

#-----------------------------------------------------------

Software: VHCS

Link: http://www.vhcs.net

Attack method: Cross Site Scripting

advisory:http://www.aria-security.net/hm/vhcs.txt

Summary:

vhcs is a powerfull Hosting Managment

Proof of Concept:

Admin Require

[target]/admin/server_day_stats.php?year=2006&month=05&day=2[xss]

[target]/admin/server_day_stats.php?year=2006&month=05[xss]&day=2

[target]/admin/server_day_stats.php?year=2006[xss]&month=05&day=2

Solution

contact me: Advisory (at) Aria-Security (dot) net [email concealed]

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

VHCS --- Virtual Hosting Control System Cross Site Scripting

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.