Xedus Multiple Vulnerabilities

vendor:

Xedus

by:

5.5

CVSS

MEDIUM

Denial of Service, Cross-Site Scripting, Directory Traversal

285, 79, 22

CWE

Product Name: Xedus

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Xedus Multiple Vulnerabilities

Xedus is susceptible to multiple vulnerabilities. The first vulnerability is a denial of service vulnerability that prevents legitimate users from accessing the hosted site. The second vulnerability is a cross-site scripting vulnerability in included sample scripts, allowing an attacker to inject malicious code. The third vulnerability is a directory traversal vulnerability, which allows an attacker to read arbitrary files outside of the configured web root.

Mitigation:

To mitigate these vulnerabilities, it is recommended to upgrade to a patched version of Xedus or apply the necessary security patches. Additionally, input validation and sanitization should be implemented to prevent cross-site scripting and directory traversal attacks.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11071/info

It is reported that Xedus is susceptible to multiple vulnerabilities.

The first reported issue is a denial of service vulnerability. The affected application is unable to service multiple simultaneous connections, denying access to the hosted site for legitimate users.

The second reported issue is a cross-site scripting vulnerability in included sample scripts. This vulnerability is due to a failure of the application to properly sanitize user-supplied URI input before including it in the output of the scripts.

The third reported issue is a directory traversal vulnerability. The affected application will reportedly serve documents located outside of the configured web root. This may allow an attacker the ability to read arbitrary, potentially sensitive files on the hosting computer with the privileges of the web server. This may aid malicious users in further attacks.

These vulnerabilities are reported to exist in version 1.0 of Xedus.

http://www.example.com:4274/test.x?username=[XSS]