SurgeFTP 'surgeftpmgr.cgi' Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	37844
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 18 2010 12:00AM
Updated:	May 31 2010 09:20PM
Credit:	indoushka
Vulnerable:	NetWin SurgeFTP 2.2 m1 NetWin SurgeFTP 2.2 k3 NetWin SurgeFTP 2.2 k1 NetWin SurgeFTP 2.0 f - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 NetWin SurgeFTP 2.0 e - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 NetWin SurgeFTP 2.0 d - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 NetWin SurgeFTP 2.0 c - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 NetWin SurgeFTP 2.0 b Win 95/98 - Microsoft Windows 95 - Microsoft Windows 98 NetWin SurgeFTP 2.0 b - Debian Linux 2.2 - Mandriva Linux Mandrake 7.2 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Redhat Linux 7.0 - Sun Solaris 8_sparc - Sun Solaris 7.0 - SuSE Linux 7.0 NetWin SurgeFTP 2.0 a Win 95/98 - Microsoft Windows 95 - Microsoft Windows 98 NetWin SurgeFTP 2.0 a - Debian Linux 2.2 - Mandriva Linux Mandrake 7.2 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Redhat Linux 7.0 - Sun Solaris 8_sparc - Sun Solaris 7.0 - SuSE Linux 7.0 NetWin SurgeFTP 2.3a6 NetWin SurgeFTP 2.3a2 NetWin SurgeFTP 2.3a1 NetWin SurgeFTP 2.0 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

SurgeFTP 'surgeftpmgr.cgi' Multiple Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

The following example URIs are available:

• /data/vulnerabilities/exploits/37844-2.txt
• /data/vulnerabilities/exploits/37844.txt

SurgeFTP 'surgeftpmgr.cgi' Multiple Cross Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].