Webcam Corp Webcam Watchdog Remote Cross-Site Scripting Vulnerability

vendor:

Webcam Watchdog

by:

Unknown

5.5

CVSS

MEDIUM

Cross-Site Scripting (XSS)

CWE

Product Name: Webcam Watchdog

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: NO

Related CWE: Not available

CPE: Not available

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Webcam Corp Webcam Watchdog Remote Cross-Site Scripting Vulnerability

The Webcam Corp Webcam Watchdog is affected by a remote cross-site scripting vulnerability in the sresult.exe binary. This vulnerability occurs due to a failure of the application to properly sanitize user-supplied input before including it in dynamically generated web content. An attacker can create a malicious link with script code that will be executed in the browser of a legitimate user by passing malicious HTML code as a value for the affected URI parameter supplied to 'sresult.exe'. This allows the attacker to execute arbitrary code within the context of the vulnerable website.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize and validate user-supplied input before including it in dynamically generated web content. Additionally, input filtering and output encoding techniques can be used to prevent XSS attacks.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10837/info

Reportedly Webcam Corp Webcam Watchdog is affected by a remote cross-site scripting vulnerability in the sresult.exe binary. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated web content.

As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. Specifically the attacker can pass malicious HTML code as a value for the affected URI parameter supplied to 'sresult.exe'. All code will be executed within the context of the website running the vulnerable software.

http://www.example.com/sresult.exe?cam=[code]