FlexWATCH Network Camera Cross-Site Scripting Vulnerability

Bugtraq ID:	18936
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 11 2006 12:00AM
Updated:	Nov 06 2006 05:02PM
Credit:	Jaime Blasco is credited with the discovery of this vulnerability.
Vulnerable:	Flexbackup Flexbackup 1.2.1
Not Vulnerable:

FlexWATCH Network Camera Cross-Site Scripting Vulnerability

FlexWATCH Network Camera is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

FlexWATCH 3.0 and prior versions are affected.

FlexWATCH Network Camera Cross-Site Scripting Vulnerability

This issue can be exploited through a web client.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/FlexWatchCameraXSSJuly112006.html

FlexWATCH Network Camera Cross-Site Scripting Vulnerability

Solution:
The vendor has released an update to address this issue. Please contact the vendor for more information on how to obtain and apply this fix.

FlexWATCH Network Camera Cross-Site Scripting Vulnerability

References:

• Digital Armaments Security Advisory 10.07.2006: Flexwath ( [email protected])