Web Video Streamer Multiple Security Vulnerabilities

vendor:

Web Video Streamer

by:

SecurityFocus

7,5

CVSS

HIGH

Cross-site Scripting, Directory-traversal, Command-injection

79, 22, 78

CWE

Product Name: Web Video Streamer

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: YES

Related CWE: N/A

CPE: a:web_video_streamer:web_video_streamer

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2014

Web Video Streamer Multiple Security Vulnerabilities

A remote attacker can leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials and gain access to sensitive information, which may aid in launching further attacks.

Mitigation:

Ensure that input is properly sanitized and validated before being used in the application.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/65350/info

Web Video Streamer is prone to following multiple security vulnerabilities:

1. Multiple cross-site scripting vulnerabilities
2. A directory-traversal vulnerability
3. A command-injection vulnerability

A remote attacker can leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials and gain access to sensitive information, which may aid in launching further attacks.

Web Video Streamer 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/webstreamer-master/player.php?name=drops.avi&file=drop.avi';ls>/tmp/foo;a'&type=video/mp4&t=1389685059
http://www.example.com/webstreamer-master/index.php?dir=../../../ XSS:
http://www.example.com/webstreamer-master/player.php?name=%3Cscript%3Ealert%281%29%3C/script%3Etest
http://www.example.com/webstreamer-master/index.php?dir=../../%3Cscript%3Ealert%281%29%3C/script%3E