NetSoft SmartNet 2.0 Cross-Site Scripting Vulnerability

2006.07.01
Risk: Low
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 2.6/10
Impact Subscore: 2.9/10
Exploitability Subscore: 4.9/10
Exploit range: Remote
Attack complexity: High
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Title: [Kil13r-SA-20060622-1] NetSoft SmartNet 2.0 Cross-Site Scripting Vulnerability Author: Kil13r - http://www.kil13r.info/ Local / Remote: Remote Timeline: 2006/06/21 - Discovery 2006/06/21 - Vendor notification 2006/06/22 - Release Affected version: NetSoft SmartNet 2.0 Not affected version: Description: NetSoft SmartNet 2.0 is search engine solution, but that has vulnerability. It can run arbitrary Javascript code by end user in search engine. If victim execute arbitrary Javascript code, attacker can steal victim's cookie. Proof of Concept code: None Proof of Concept example: http://www.victim.com/dataCollector/search.jsp?searchFLD=0&tableName=_me ta&keyWord=<script>alert("XSS")</script> http://www.victim.com/dataCollector/search.asp?searchFLD=0&tableName=_me ta&keyWord=<script>alert("XSS")</script> Proof of Concept screenshot: http://www.kil13r.info/sa/xss/smartnetxss.jpg - Igitur qui desiderat pacem, praeparet bellum.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top