Zeeways ZEEPROPERTY Arbitrary File Upload and Cross Site Scripting Vulnerabilities
BID:32224
Info
Zeeways ZEEPROPERTY Arbitrary File Upload and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 32224 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-6914 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 08 2008 12:00AM |
| Updated: | May 07 2015 05:21PM |
| Credit: | ZoRLu |
| Vulnerable: |
ZEEWAYS ZEEPROPERTY 1.0 |
| Not Vulnerable: | |
Discussion
Zeeways ZEEPROPERTY Arbitrary File Upload and Cross Site Scripting Vulnerabilities
Zeeways ZEEPROPERTY is prone to an arbitrary-file-upload vulnerability that lets attackers upload and execute arbitrary code. The application is also prone to a cross-site scripting issue. These issues occur because the application fails to sufficiently sanitize user-supplied input.
Attackers can exploit these issues to steal cookie information, execute arbitrary client side script code in the context of browser, upload and execute arbitrary files in the context of the webserver, and launch other attacks.
These issues affect ZEEPROPERTY 1.0; other versions may also be affected.
Zeeways ZEEPROPERTY is prone to an arbitrary-file-upload vulnerability that lets attackers upload and execute arbitrary code. The application is also prone to a cross-site scripting issue. These issues occur because the application fails to sufficiently sanitize user-supplied input.
Attackers can exploit these issues to steal cookie information, execute arbitrary client side script code in the context of browser, upload and execute arbitrary files in the context of the webserver, and launch other attacks.
These issues affect ZEEPROPERTY 1.0; other versions may also be affected.
Exploit / POC
Zeeways ZEEPROPERTY Arbitrary File Upload and Cross Site Scripting Vulnerabilities
Attackers may exploit this issue through a browser.
The following example URI is available for the cross-site scripting issue:
http://www.example.com/view_prop_details.php?propid="><script>alert()</script>
Attackers may exploit this issue through a browser.
The following example URI is available for the cross-site scripting issue:
http://www.example.com/view_prop_details.php?propid="><script>alert()</script>
Solution / Fix
Zeeways ZEEPROPERTY Arbitrary File Upload and Cross Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Zeeways ZEEPROPERTY Arbitrary File Upload and Cross Site Scripting Vulnerabilities
References:
References:
- ZEEPROPERTY Homepage (ZEEWAYS)