Summit Computer Networks Lil' HTTP Server URLCount.CGI HTML Injection Vulnerability

Bugtraq ID:	5115
Class:	Input Validation Error
CVE:	CVE-2002-1008
Remote:	Yes
Local:	No
Published:	Jun 27 2002 12:00AM
Updated:	Jul 11 2009 01:56PM
Credit:	Credited to "Matthew Murphy" <[email protected]>.
Vulnerable:	Summit Computer Networks Lil'HTTP 2.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Summit Computer Networks Lil'HTTP 2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 PowerBASIC EZCount
Not Vulnerable:

Summit Computer Networks Lil' HTTP Server URLCount.CGI HTML Injection Vulnerability

Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks.

Reportedly, Lil' HTTP Server is vulnerable to HTML injection attacks.

The vulnerability is present in the 'REPORT' function found in the 'urlcount.cgi' script. While the CGI does filter script tags, other HTML elements are not sufficiently sanitized, allowing for arbitrary HTML to be injected into the reports page.

Summit Computer Networks Lil' HTTP Server URLCount.CGI HTML Injection Vulnerability

The following example was submitted:

http://target/urlcount.cgi?%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28%27xss%27%29%22%3E

This will affect web users who visit the reports page:

http://target/urlcount.cgi?REPORT