HomeSeer HS2 2.5.0.20 – Web Interface Log Viewer Page URI Cross-Site Scripting

• Exploit Database
• 21 阅读

• 作者： Silent Dream
  日期： 2011-12-08
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/36429/

• source: https://www.securityfocus.com/bid/50978/info
  
  HS2 web interface is prone to multiple security vulnerabilities:
  
  1. An HTML-injection vulnerability.
  2. A cross-site request-forgery vulnerability.
  3. A directory-traversal vulnerability.
  
  Attackers can exploit these issues to perform certain actions in the context of an authorized user's session, run arbitrary HTML and script code, and transfer files outside of the web directory. Other attacks may also be possible.
  
  HomeSeer HS2 2.5.0.20 is vulnerable; prior versions may also be affected. 
  
  http://www.example.com/example<script>alert(document.cookie)</script>