HotspotExpress HotExBilling Manager 'hotspotlogin.cgi' Cross Site Scripting Vulnerability
BID:73941
Info
HotspotExpress HotExBilling Manager 'hotspotlogin.cgi' Cross Site Scripting Vulnerability
| Bugtraq ID: | 73941 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-2781 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 05 2015 12:00AM |
| Updated: | Apr 05 2015 12:00AM |
| Credit: | Bhadresh Patel |
| Vulnerable: |
HotspotExpress HotExBilling Manager V73 |
| Not Vulnerable: | |
Discussion
HotspotExpress HotExBilling Manager 'hotspotlogin.cgi' Cross Site Scripting Vulnerability
HotspotExpress HotExBilling Manager is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
HotspotExpress HotExBilling Manager is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Solution / Fix
HotspotExpress HotExBilling Manager 'hotspotlogin.cgi' Cross Site Scripting Vulnerability
Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.
References
HotspotExpress HotExBilling Manager 'hotspotlogin.cgi' Cross Site Scripting Vulnerability
References:
References:
- HotExBilling Manager Cross-site scripting (XSS) vulnerability (Bhadresh Patel)
- HotspotExpress HotExBilling - Homepage (HotspotExpress)