Exploit HomeSeer HS2 2.5.0.20 - Web Interface Log Viewer Page URI Cross-Site Scripting

[Exploiter]

EDB-ID

36429

Проверка EDB

1. Пройдено

Автор

SILENT DREAM

Тип уязвимости

REMOTE

Платформа

HARDWARE

CVE

cve-2011-4836

Дата публикации

2011-12-08

HomeSeer HS2 2.5.0.20 - Web Interface Log Viewer Page URI Cross-Site Scripting

source: https://www.securityfocus.com/bid/50978/info

HS2 web interface is prone to multiple security vulnerabilities:

1. An HTML-injection vulnerability.
2. A cross-site request-forgery vulnerability.
3. A directory-traversal vulnerability.

Attackers can exploit these issues to perform certain actions in the context of an authorized user's session, run arbitrary HTML and script code, and transfer files outside of the web directory. Other attacks may also be possible.

HomeSeer HS2 2.5.0.20 is vulnerable; prior versions may also be affected. 

http://www.example.com/example<script>alert(document.cookie)</script>