Ecometry SGDynamo Cross-Site Scripting Vulnerability
BID:4720
Info
Ecometry SGDynamo Cross-Site Scripting Vulnerability
| Bugtraq ID: | 4720 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0375 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 17 2002 12:00AM |
| Updated: | Jul 11 2009 12:46PM |
| Credit: | Discovery of this issue is credited to frog frog <[email protected]>. |
| Vulnerable: |
Ecometry SGDynamo 7.0 Ecometry SGDynamo 6.1 Ecometry SGDynamo 5.32 U Ecometry SGDynamo 5.32 T |
| Not Vulnerable: | |
Discussion
Ecometry SGDynamo Cross-Site Scripting Vulnerability
SGDynamo is a web application engine for Microsoft Windows operating systems.
Script code is not filtered from URL parameters that are used as output by the SGDynamo program. This may enable an attacker to inject script code into a malicious link to the program. The script code will be executed in the browser of a user who visits the link, in the context of the site running the program.
This may enable the attacker to steal cookie-based authentication credentials from legitimate users.
SGDynamo is a web application engine for Microsoft Windows operating systems.
Script code is not filtered from URL parameters that are used as output by the SGDynamo program. This may enable an attacker to inject script code into a malicious link to the program. The script code will be executed in the browser of a user who visits the link, in the context of the site running the program.
This may enable the attacker to steal cookie-based authentication credentials from legitimate users.
Exploit / POC
Ecometry SGDynamo Cross-Site Scripting Vulnerability
The following example may be used to reproduce this condition:
http://target/sgdynamo.exe?HTNAME=<script>alert("test")</script>
The following example may be used to reproduce this condition:
http://target/sgdynamo.exe?HTNAME=<script>alert("test")</script>
Solution / Fix
Ecometry SGDynamo Cross-Site Scripting Vulnerability
Solution:
The vendor has released fixes for versions 5.32T are later. Those affected are advised to contact their Ecometry Customer Support Rep in order to obtain the fixed code. Users should reference Job # 181625-01 when requesting information about the availablity of fixes.
Solution:
The vendor has released fixes for versions 5.32T are later. Those affected are advised to contact their Ecometry Customer Support Rep in order to obtain the fixed code. Users should reference Job # 181625-01 when requesting information about the availablity of fixes.
References
Ecometry SGDynamo Cross-Site Scripting Vulnerability
References:
References:
- Smalls holes on 5 products #1 (frog frog