Mobotix IP Camera Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	18022
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 17 2006 12:00AM
Updated:	Aug 21 2006 04:49PM
Credit:	Jaime Blasco is credited with the discovery of these vulnerabilities.
Vulnerable:	Mobotix Mobotix IP Camera M10 2.0.5 .2 Mobotix Mobotix IP Camera M1 1.9.4 .7
Not Vulnerable:	Mobotix Mobotix IP camera 3.0.3 31 Mobotix Mobotix IP camera 2.2.3.18

Mobotix IP Camera Multiple Cross-Site Scripting Vulnerabilities

The Mobotix IP camera is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the device to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Mobotix IP Camera Multiple Cross-Site Scripting Vulnerabilities

These issues can be exploited through a web client.

The following proof-of-concept URIs are available:

• /data/vulnerabilities/exploits/Mobotix-0517-xss.txt

Mobotix IP Camera Multiple Cross-Site Scripting Vulnerabilities

Solution:
The vendor has released updates to address this issue. Please see the references for more information.

Mobotix IP Camera Multiple Cross-Site Scripting Vulnerabilities

References:

• Mobotix IP Network Cameras Multiple XSS (jaime.blasco)
  
• Vendor Homepage (Mobotix)
  
• Mobotix IP Network Cameras Multiple XSS ([email protected])