HomeSeer HS2 2.5.0.20 – Web Interface Log Viewer Page URI Cross-Site Scripting

• Exploit Database
• 128 阅读

• 作者： Silent Dream
  日期： 2011-12-08
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/36429/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14

  source: https://www.securityfocus.com/bid/50978/info   HS2 web interface is prone to multiple security vulnerabilities:   1. An HTML-injection vulnerability. 2. A cross-site request-forgery vulnerability. 3. A directory-traversal vulnerability.   Attackers can exploit these issues to perform certain actions in the context of an authorized user&apos;s session, run arbitrary HTML and script code, and transfer files outside of the web directory. Other attacks may also be possible.   HomeSeer HS2 2.5.0.20 is vulnerable; prior versions may also be affected.   http://www.example.com/example<script>alert(document.cookie)</script>