|
Description
|
|
Eric Sesterhenn has discovered multiple vulnerabilities in Web Video Streamer, which can be exploited by malicious people to conduct cross-site scripting attacks and compromise a vulnerable system.
1) Input passed via the "dir" GET parameter to index.php and the "name" GET parameter to player.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) Input passed via the "file" GET parameter to player.php is not properly sanitised before being used in an "exec()" call. This can be exploited to inject and execute arbitrary shell commands.
The vulnerabilities are confirmed in version 1.0.
|
