Zeus Web Server Admin Interface VS_Diag.CGI Cross Site Scripting Vulnerability

Bugtraq ID:	7751
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 29 2003 12:00AM
Updated:	May 29 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Hugo "Vázquez" "Caramés" <[email protected]>.
Vulnerable:	Zeus Technologies Zeus Web Server 4.2 r2 Zeus Technologies Zeus Web Server 4.2 Zeus Technologies Zeus Web Server 4.1 r5 Zeus Technologies Zeus Web Server 4.1 r4 Zeus Technologies Zeus Web Server 4.1 r3 Zeus Technologies Zeus Web Server 4.1 r2 Zeus Technologies Zeus Web Server 4.1 r1 Zeus Technologies Zeus Web Server 4.1 Zeus Technologies Zeus Web Server 4.0
Not Vulnerable:

Zeus Web Server Admin Interface VS_Diag.CGI Cross Site Scripting Vulnerability

The Zeus Web Server contains a web based administration interface that is vulnerable to cross site scripting attacks.

Due to insufficient sanitization of user-supplied input, it is possible for an attacker to construct a malicious link which contains arbitrary HTML and script code, which will be executed in the web client of a user who visits the malicious link. It should be noted that the user must authenticate with the administrative interface for the attack to succeed.

The vendor has stated that cookies are not used to store usernames and passwords.

Zeus Web Server Admin Interface VS_Diag.CGI Cross Site Scripting Vulnerability

References:

• Zeus Technology Homepage (Zeus Technology)
  
• Another ZEUS Server web admin XSS! (Hugo "Vázquez" "Caramés" )
  
• Re: Another ZEUS Server web admin XSS! ()