Check Point Connectra '/Login/Login' Arbitrary Script Injection Vulnerability
BID:36466
Info
Check Point Connectra '/Login/Login' Arbitrary Script Injection Vulnerability
| Bugtraq ID: | 36466 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 21 2009 12:00AM |
| Updated: | Sep 22 2009 10:20PM |
| Credit: | Stefan Friedli from scip AG |
| Vulnerable: |
Check Point Software Connectra R62 |
| Not Vulnerable: | |
Discussion
Check Point Connectra '/Login/Login' Arbitrary Script Injection Vulnerability
Check Point Connectra is prone to an arbitrary-script-injection vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this issue to execute arbitrary script code in the context of the webserver. Successful exploits can compromise the application.
Check Point Connectra is prone to an arbitrary-script-injection vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this issue to execute arbitrary script code in the context of the webserver. Successful exploits can compromise the application.
Exploit / POC
Check Point Connectra '/Login/Login' Arbitrary Script Injection Vulnerability
Attackers can exploit this issue via a browser.
The following exploit code is available:
Attackers can exploit this issue via a browser.
The following exploit code is available:
Solution / Fix
Check Point Connectra '/Login/Login' Arbitrary Script Injection Vulnerability
Solution:
Updates are available. Please contact the vendor for details.
Solution:
Updates are available. Please contact the vendor for details.
References
Check Point Connectra '/Login/Login' Arbitrary Script Injection Vulnerability
References:
References:
- Connectra Homepage (Check Point)
- [scip_Advisory 4020] Check Point Connectra R62 Login Script Injection Vulnerabil ("Stefan Friedli"