WebGUI Security Bypass and Multiple Cross Site Scripting Vulnerabilities
BID:31797
Info
WebGUI Security Bypass and Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 31797 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 09 2008 12:00AM |
| Updated: | Oct 20 2008 04:27PM |
| Credit: | Graham, WebGUI |
| Vulnerable: |
WebGUI WebGUI 7.5.25 |
| Not Vulnerable: |
WebGUI WebGUI 7.5.26 |
Discussion
WebGUI Security Bypass and Multiple Cross Site Scripting Vulnerabilities
WebGUI is prone to a security-bypass vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly validate user credentials and sanitize user-supplied input.
An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The attacker may leverage the security-bypass issue to reset an arbitrary user's password and gain access to the user's account.
WebGUI 7.5.25 is vulnerable; other versions may also be affected.
WebGUI is prone to a security-bypass vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly validate user credentials and sanitize user-supplied input.
An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The attacker may leverage the security-bypass issue to reset an arbitrary user's password and gain access to the user's account.
WebGUI 7.5.25 is vulnerable; other versions may also be affected.
Exploit / POC
WebGUI Security Bypass and Multiple Cross Site Scripting Vulnerabilities
Attackers can use a browser to exploit the issues. For a cross-site scripting attack, attackers will entice an unsuspecting user to follow a malicious URI.
Attackers can use a browser to exploit the issues. For a cross-site scripting attack, attackers will entice an unsuspecting user to follow a malicious URI.
Solution / Fix
WebGUI Security Bypass and Multiple Cross Site Scripting Vulnerabilities
Solution:
The vendor has released an update. Please see the references for more information.
Solution:
The vendor has released an update. Please see the references for more information.
References
WebGUI Security Bypass and Multiple Cross Site Scripting Vulnerabilities
References:
References:
- WebGUI - Homepage (WebGUI)
- WebGUI 7.5.26 (stable) Released (WebGUI)