Multiple Cross-Site Scripting Vulnerabilities in BackupPC

vendor:

BackupPC

by:

Unknown

5.5

CVSS

MEDIUM

Cross-Site Scripting

CWE

Product Name: BackupPC

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: Unknown

Related CWE:

CPE: a:backuppc:backuppc

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Multiple Cross-Site Scripting Vulnerabilities in BackupPC

BackupPC is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mitigation:

To mitigate these vulnerabilities, it is recommended to sanitize user-supplied data before using it in dynamic web content. Additionally, implementing a content security policy (CSP) can help prevent cross-site scripting attacks.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/47628/info

BackupPC is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/index.cgi?action=browse&amp;amp;host=localhost&amp;amp;num=99999%22%3E%3Cscript%3Ealert%28123%29%3C/script%3E
http://www.example.com/index.cgi?action=RestoreFile&amp;amp;host=localhost&amp;amp;num=1&amp;amp;share=%3Cscript%3Ealert%28234%29%3C/script%3E&amp;amp;dir=