GoAhead WebServer Multiple HTML Injection Vulnerabilities

Bugtraq ID:	50039
Class:	Input Validation Error
CVE:	CVE-2011-4273
Remote:	Yes
Local:	No
Published:	Oct 10 2011 12:00AM
Updated:	Nov 04 2011 05:23PM
Credit:	Silent Dream
Vulnerable:	GoAhead Software GoAhead WebServer 2.18
Not Vulnerable:

GoAhead WebServer Multiple HTML Injection Vulnerabilities

GoAhead WebServer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

GoAhead WebServer 2.18 is vulnerable; other versions may also be affected.

GoAhead WebServer Multiple HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

• /data/vulnerabilities/exploits/50039.txt

GoAhead WebServer Multiple HTML Injection Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

GoAhead WebServer Multiple HTML Injection Vulnerabilities

References:

• GoAhead WebServer Product Homepage (GoAhead Software)
  
• GoAhead Webserver multiple stored XSS vulnerabilities (Silent Dream)