Cross-Site Scripting in Macromedia Dreamweaver MX PHP Authentication Suite

vendor:

Dreamweaver MX

by:

SecurityFocus

7.5

CVSS

HIGH

Cross-Site Scripting

CWE

Product Name: Dreamweaver MX

Affected Version From: Dreamweaver MX

Affected Version To: Dreamweaver MX

Patch Exists: No

Related CWE: N/A

CPE: Dreamweaver MX

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

Cross-Site Scripting in Macromedia Dreamweaver MX PHP Authentication Suite

A cross-site-scripting vulnerability has been reported to affect PHP authentication functions used in PHP access control pages created with the Macromedia Dreamweaver MX PHP Authentication Suite. An attacker may exploit this condition to execute arbitrary HTML code in the browser of an unsuspecting user.

Mitigation:

Ensure that user-supplied input is properly validated and filtered before being used in the application.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8339/info

It is possible to create an authentication or access control page, using Dreamweaver MX PHP Authentication Suite. This script will generate an error page that contains dynamic content when a user fails to authenticate correctly to the site.

A cross-site-scripting vulnerability has been reported to affect PHP authentication functions used in PHP access control pages created with the Macromedia Dreamweaver MX PHP Authentication Suite.

An attacker may exploit this condition to execute arbitrary HTML code in the browser of an unsuspecting user.

http://www.example.com/[PATH]/[LOGIN PAGE].php?[ACCESS DENIED VARIABLE]
="><script>alert('.::\/\|NSRG-18-7|/\/::.');</script>