Exploit Fastream NetFile 6.0.3.588 - Error Message Cross-Site Scripting

[Exploiter]

EDB-ID

23307

Проверка EDB

1. Пройдено

Автор

OLIVER KAROW

Тип уязвимости

REMOTE

Платформа

MULTIPLE

CVE

cve-2003-1151

Дата публикации

2003-10-28

source: https://www.securityfocus.com/bid/8908/info

It has been reported that a cross-site scripting vulnerability may exist in NetFile that may allow remote attackers to execute HTML or script code in a user's browser. The issue is reported to occur due to a "404 Not Found" error message returned to the user due to a request for a URL that does not exist. The error message reportedly contains the bad URL which is not properly sanitized therefore allowing an attacker to a construct a malicious link containing HTML or script code that may be rendered in a user's browser.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

NetFile FTP/Webserver Version 6.0.3.588 has been reported to be prone to this issue, however other versions may be affected as well. 

http://www.example.com/<script>alert("bang")</script>