vendor:
InJoin Directory
by:
SecurityFocus
7.5
CVSS
HIGH
Script Injection
79
CWE
Product Name: InJoin Directory
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Microsoft Windows, Unix variants
2002
InJoin Directory URL Parameter Script Injection Vulnerability
InJoin Directory is provided for Microsoft Windows operating systems and Unix variants. HTML code is not filtered from URL parameters that are used as output in the web-based administrative interface. This enables an attacker to inject malicious script code into a link to the administrative interface. When this link is visited by an authenticated administrative user, the attacker's script code will be executed in the browser of that user, in the security context of the site running the interface. Successful exploitation may allow the attacker to steal cookie-based authentication credentials from the administrative user.
Mitigation:
Filter user input and escape special characters in URL parameters.
