Embedthis Appweb Web Server 3.2.2-1 (Ejscript) Remote XSS Vulnerability
Vendor: Embedthis Software LLC
Product web page: http://www.appwebserver.org, http://www.ejscript.org
Version affected: 3.2.2-1
Summary: Appweb has a multi-threaded, event-driven, core to deliver
exceptional throughput, response and outstanding memory utilization.
It is compact and will embed using as little as 800K of memory.
Desc: Appweb Web Server suffers from a remote reflected Cross-Site
Scripting vulnerability when input passed to the Ejscript web
framework is not properly sanitized, allowing the attacker to
execute arbitrary HTML and script code in a user's browser
session and aid in phishing attacks.
Tested on: Microsoft Windows XP Professional SP3 (EN)
Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Zero Science Lab - http://www.zeroscience.mk
Advisory ID: ZSL-2010-4985
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4985.php
12.10.2010
PoC:
http://localhost/ejs/%3Cscript%3Ealert%281%29%3C/script%3E