Falcon Series One Multiple Input-Validation Vulnerabilities

vendor:

Falcon Series One

by:

Unknown

N/A

CVSS

N/A

Input-validation vulnerabilities

Unknown

CWE

Product Name: Falcon Series One

Affected Version From: 1.4.2003

Affected Version To: Unknown

Patch Exists: Unknown

Related CWE: Unknown

CPE: Unknown

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Falcon Series One Multiple Input-Validation Vulnerabilities

Falcon Series One is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input. These issues include a remote file-include vulnerability and multiple HTML-injection vulnerabilities. Exploiting these issues can allow attacker-supplied HTML or script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Mitigation:

Unknown

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/26798/info

Falcon Series One is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input. These issues include a remote file-include vulnerability and multiple HTML-injection vulnerabilities.

Exploiting these issues can allow attacker-supplied HTML or script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Falcon Series One 1.4.3 stable is vulnerable; other versions may also be affected. 

http://www.example.com/sitemap.xml.php?dir[classes]=[Evil_Code]