Detections
Analytics
IceWarp install/index.html lang Parameter XSS
medium Nessus Plugin ID 53869
Language:
Synopsis
The remote web server contains a PHP script that is susceptible to a cross-site scripting attack.Description
The remote web server hosts a PHP script that is susceptible to a cross-site scripting attack. The script 'install/index.html' does not properly sanitize input data to the 'lang' parameter before including it in HTML generated dynamically.As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed.
This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Solution
Upgrade to version 10.3.0 or later.See Also
Plugin Details
Severity: Medium
ID: 53869
File Name: icewarp_install_index_lang_param_xss.nasl
Version: 1.9
Type: remote
Family: CGI abuses : XSS
Published: 5/11/2011
Updated: 1/19/2021
Supported Sensors: Nessus
Vulnerability Information
CPE: cpe:/a:icewarp:webmail
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/29/2011
Vulnerability Publication Date: 5/5/2011
Reference Information
BID: 47723