vendor:
W-Agora
by:
indoushka
8,8
CVSS
HIGH
XSS and File Inclusion
79 (XSS) and 22 (File Inclusion)
CWE
Product Name: W-Agora
Affected Version From: 4.2.1
Affected Version To: 4.2.1
Patch Exists: NO
Related CWE: N/A
CPE: a:w-agora:w-agora:4.2.1
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux
2009
W-Agora v.4.2.1 Multiple Vulnerabilities
W-Agora v.4.2.1 is vulnerable to XSS and File Inclusion. An attacker can exploit this vulnerability by sending a malicious URL to the victim. The malicious URL contains a malicious script which will be executed when the victim visits the URL. The malicious URL also contains a file inclusion parameter which can be used to include a malicious file from a remote server. This can be used to execute arbitrary code on the victim's system.
Mitigation:
The application should be configured to validate user input and filter out any malicious scripts. The application should also be configured to only allow the inclusion of files from trusted sources.
