Keene Digital Media Server Multiple Cross-Site Scripting Vulnerabilities

vendor:

Digital Media Server

by:

Unknown

4.3

CVSS

MEDIUM

Cross-Site Scripting (XSS)

CWE

Product Name: Digital Media Server

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: NO

Related CWE:

CPE: a:keene:digital_media_server

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Keene Digital Media Server Multiple Cross-Site Scripting Vulnerabilities

The Keene Digital Media Server is prone to multiple cross-site scripting vulnerabilities. These vulnerabilities exist in multiple scripts and are caused by a lack of proper input sanitization. An attacker can exploit these vulnerabilities by tricking a user into clicking on a malicious link. Successful exploitation could result in the theft of authentication credentials or other malicious activities.

Mitigation:

To mitigate these vulnerabilities, it is recommended to implement proper input validation and sanitization techniques. Additionally, users should be cautious when clicking on links from untrusted sources.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11111/info

Keene Digital Media Server is prone to multiple cross-site scripting vulnerabilities. These issues span multiple scripts. The source of the problem is that affected scripts do not sufficiently sanitize externally supplied data before rendering it to a client user. An attacker may exploit these issues by enticing a victim user to follow a malicious link.

These issues could be exploited to steal cookie-based authentication credentials or launch other attacks.

http://www.example.com/dms/slideshow.kspx?shidx=0&idx=-1&sort=d&style=t&delay=15&playmode=play&source=[code]
http://www.example.com/dms/slideshow.kspx?source=[code]
http://www.example.com/dms/dlasx.kspx?shidx=[code]
http://www.example.com/igen/?pg=dlasx.kspx&shidx=[code]
http://www.example.com/dms/mediashowplay.kspx?pic=[code]&idx=0
http://www.example.com/dms/mediashowplay.kspx?pic=0&idx=[code]