header-logo
Suggest Exploit
vendor:
AutoIndex PHP Script
by:
4.3
CVSS
MEDIUM
Cross-site Scripting
79
CWE
Product Name: AutoIndex PHP Script
Affected Version From: 2.2.2001
Affected Version To: 2.2.2001
Patch Exists: NO
Related CWE:
CPE: a:autoindex_project:autoindex:2.2.1
Metasploit:
Other Scripts:
Platforms Tested:

Cross-site Scripting Vulnerability in AutoIndex PHP Script

The AutoIndex PHP Script is vulnerable to a cross-site scripting (XSS) attack due to insufficient sanitization of user-supplied input data. An attacker can exploit this vulnerability to execute arbitrary script code in the browser of an unsuspecting user, within the context of the affected site. This can lead to the theft of cookie-based authentication credentials and the launch of further attacks.

Mitigation:

To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization techniques. Additionally, developers should also consider implementing Content Security Policy (CSP) to mitigate the impact of XSS attacks.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/25448/info

AutoIndex PHP Script is prone a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AutoIndex PHP Script 2.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/AutoIndex/index.php?search=asdf&search_mode=[xss]

Navigation

Suggest Exploit

Services By CQR