Summit Computer Networks Lil' HTTP Server pbcgi.cgi Cross Site Scripting Vulnerability
BID:5211
Info
Summit Computer Networks Lil' HTTP Server pbcgi.cgi Cross Site Scripting Vulnerability
| Bugtraq ID: | 5211 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-1009 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 11 2002 12:00AM |
| Updated: | Jul 11 2009 02:56PM |
| Credit: | Discovered by Matthew Murphy <[email protected]>. |
| Vulnerable: |
Summit Computer Networks Lil'HTTP 2.2 Summit Computer Networks Lil'HTTP 2.1 |
| Not Vulnerable: | |
Discussion
Summit Computer Networks Lil' HTTP Server pbcgi.cgi Cross Site Scripting Vulnerability
Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks.
It is possible for attackers to construct a URL to the 'pbcgi.cgi' script which includes scripting code to execute in a user's browser. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site.
Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks.
It is possible for attackers to construct a URL to the 'pbcgi.cgi' script which includes scripting code to execute in a user's browser. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site.
Exploit / POC
Summit Computer Networks Lil' HTTP Server pbcgi.cgi Cross Site Scripting Vulnerability
Matthew Murphy <[email protected]> has provided the following example:
http://localhost:81/pbcgi.cgi?name=Matthew%20Murphy&email=%3CSCRIPT%3Ealert%
28%27xss%27%29%3B%3C%2FSCRIPT%3E
Matthew Murphy <[email protected]> has provided the following example:
http://localhost:81/pbcgi.cgi?name=Matthew%20Murphy&email=%3CSCRIPT%3Ealert%
28%27xss%27%29%3B%3C%2FSCRIPT%3E
Solution / Fix
Summit Computer Networks Lil' HTTP Server pbcgi.cgi Cross Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Summit Computer Networks Lil' HTTP Server pbcgi.cgi Cross Site Scripting Vulnerability
References:
References:
- Lil' HTTP Homepage (Summit Computer Networks)