qcred11
Jul 2 2004, 02:59 PM
| QUOTE |
Application: SCI Photo Chat Server
http://www.simmcomm.ch/
Version: 3.4.9
Bug: cross site scripting
Date: 02-Jul-2004
Author: Donato Ferrante
e-mail: fdonato@autistici.org
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1. Description
2. The bug
3. The code
4. The fix
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
----------------
1. Description:
----------------
Vendor's Description:
"SCI Java Photo Chat Server is a multithreaded chat server that
supports multimedia pictures, sounds, or even videos. It features an
integrated HTTP server for transferring images and other media files;
a JDBC database interface (tested on PostgreSQL and MYSql) for
validating user/password logins; server-side global configuration-file
and license management; and more."
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
------------
2. The bug:
------------
The input strings are not filtered by the server so they will appear
in the returned page.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-------------
3. The code:
-------------
To test the vulnerability:
http://[host]:1235/<script>alert("hy")</script>
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
------------
4. The fix:
------------
No fix.
The vendor has not answered to my signalations.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
Link is unavailable
Sent by mailing list
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please
click here.
