Multiple Cross-Site Scripting Vulnerabilities in DCP-Portal

vendor:

DCP-Portal

by:

Unknown

5.5

CVSS

MEDIUM

Cross-Site Scripting (XSS)

CWE

Product Name: DCP-Portal

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: NO

Related CWE: Unknown

CPE: a:dcp-portal:dcp-portal

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

Multiple Cross-Site Scripting Vulnerabilities in DCP-Portal

DCP-Portal is prone to multiple cross-site scripting vulnerabilities due to insufficient filtering of URI parameters supplied to several scripts. A remote attacker can exploit this vulnerability by creating a malicious link containing script code. When a legitimate user follows the link, the script code will be executed in their browser within the context of the vulnerable website. This can lead to theft of cookie-based authentication credentials and other attacks.

Mitigation:

To mitigate these vulnerabilities, it is recommended to implement proper input validation and output encoding to prevent malicious code execution. Additionally, using a web application firewall (WAF) can provide an added layer of protection against XSS attacks.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11338/info
 
DCP-Portal is reported prone to multiple cross-site scripting vulnerabilities. It is reported that DCP-Portal does not sufficiently filter URI parameters supplied to several scripts.
 
Because of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user if the link is followed. The script code contained in the URI parameter will be executed in the context of the vulnerable website.
 
This may allow for theft of cookie-based authentication credentials and other attacks.

http://www.example.com/index.php?page=annoucements&cid=[XSS code here]