Detections
Analytics
FireStats window-add-excluded-ip.php 'edit' parameter XSS
medium Nessus Plugin ID 47746
Language:
Synopsis
The remote web server hosts a web application that is affected by a cross-site scripting vulnerability.Description
The version of FireStats installed on the remote host fails to properly sanitize user-supplied input to the 'edit' parameter of the 'window-add-excluded-ip.php' script.An unauthenticated, remote attacker can leverage this issue to execute arbitrary script code in a user's browser.
Note that this version of FireStats is likely affected by cross-site scripting issues in multiple other scripts; however, Nessus has not tested for these.
Solution
Upgrade to version 1.6.6 or later.See Also
http://www.nessus.org/u?caf07989
https://downloads.securityfocus.com/vulnerabilities/exploits/41548.txt
Plugin Details
Severity: Medium
ID: 47746
File Name: firestats_excluded_ip_edit_xss.nasl
Version: 1.15
Type: remote
Family: CGI abuses : XSS
Published: 7/16/2010
Updated: 6/4/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Vulnerability Information
CPE: cpe:/a:edgewall:firestats
Required KB Items: www/PHP, installed_sw/FireStats
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/16/2010
Vulnerability Publication Date: 7/9/2010
Reference Information
BID: 41548