|
Description
|
|
Several vulnerabilities were reported in WebAdmin, which could be exploited by users to conduct Cross Site Scripting attacks or bypasse security features. The first flaw is due to an input validation error in the "useredit_account.wdm" script when handling the "user" variable, which may be exploited by anonymous users to conduct Cross Site Scripting attacks or by authenticated users to gain access to arbitrary accounts. The second vulnerability resindes in the "modalframe.wdm" file, and could be exploited to inject third party pages into the user's browser.
Examples :
http://vulnerable/WebAdmin/useredit_account.wdm?user=javascript_code
http://vulnerable/WebAdmin/useredit_account.wdm?user=any_user@domain
http://vulnerable/WebAdmin/modalframe.wdm?file=any_page
|
