GoAhead Web Server 2.18 – ‘adduser.asp’ Multiple Cross-Site Scripting Vulnerabilities

Exploit Database
14 阅读

作者： Silent Dream

日期： 2011-10-10
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/36219/

source: https://www.securityfocus.com/bid/50039/info

GoAhead WebServer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

GoAhead WebServer 2.18 is vulnerable; other versions may also be affected. 

POST /goform/AddUser HTTP/1.1
user=%3Cscript%3Ealert%281337%29%3C%2Fscript%3E&group=%3Cscript%3Ealert%281337%2
9%3C%2Fscript%3E&enabled=on&password=test&passconf=test&ok=OK

last Exploits
GoAhead Web Server 2.18 – ‘adduser.asp’ Multiple Cross-Site Scripting Vulnerabilities的更多信息

Ruby 1.9.1 – WEBrick ‘Terminal Escape Sequence in Logs’ Command Injection：
HP OpenView – Operations OVTrace Buffer Overflow (Metasploit)：
Mutiny 5 – Arbitrary File Upload (Metasploit)：
FlashFXP 4.1.8.1701 – Remote Buffer Overflow：
EasyFTP Server 1.7.0.11 – ‘LIST’ (Authenticated) Remote Buffer Overflow：
Sielco Sistemi Winlog 2.07.14 – Remote Buffer Overflow (Metasploit)：
Python RRDtool Module – Function Format String：
Check Point UTM-1 Edge and Safe 8.2.43 – Multiple Vulnerabilities：