Detections
Analytics
CjOverkill trade.php Multiple Method XSS
medium Nessus Plugin ID 15462
Language:
Synopsis
The remote web server runs a CGI application that is affected by a cross-site scripting vulnerability.Description
The remote server runs a version of CjOverkill, a free traffic trading script that is as old as or older than version 4.0.3.The remote version of this software is affected by a cross-site scripting vulnerability in the script 'trade.php'. This issue is due to a failure of the application to properly sanitize user-supplied input.
As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed.
This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Solution
Upgrade to version 4.0.4 or later.See Also
Plugin Details
Severity: Medium
ID: 15462
File Name: cjoverkill_xss.nasl
Version: 1.27
Type: remote
Family: CGI abuses : XSS
Published: 10/12/2004
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:cjoverkill:cjoverkill
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 10/11/2004
Reference Information
CVE: CVE-2004-2193
BID: 11359