The remote host is running a version of PHP-Fusion that does not sufficiently sanitize JavaScript code.  Specifically, an attacker can inject JavaScript code that bypasses the filters in 'fusion_core.php' by HTML-encoding it.  This code will then be executed in the context of a user's browser when viewing the malicious BBcode on the remote host.

According to its version number, the remote host is running a version of CuteNews that allows an attacker to inject arbitrary script through the variables 'X-FORWARDED-FOR' or 'CLIENT-IP' when adding a comment. On one hand, an attacker can inject a client-side script to be executed by an administrator's browser when he/she chooses to edit the added comment.  On the other, an attacker with local access could leverage this flaw to run arbitrary PHP code in the context of the web server user. 

Additionally, it suffers from a cross-site scripting flaw involving the 'search.php' script.

The remote host is running Ultraseek, an enterprise search engine. This version has a cross-site scripting vulnerability.  Successful exploitation of this issue may allow an attacker to execute malicious script code on a vulnerable server.

The installed version of phpMyAdmin suffers from multiple cross-site scripting vulnerabilities due to its failure to sanitize user input in several PHP scripts used as libraries and themes.  A remote attacker may use these issues to cause arbitrary code to be executed in a user's browser, to steal authentication cookies and the like.

According to the version number in its banner, the installation of Invision Power Board on the remote host reportedly does not sufficiently sanitize the 'COLOR' SML tag. A remote attacker may exploit this vulnerability by adding a specially crafted 'COLOR' tag with arbitrary JavaScript to any signature or post on an Invision board. That JavaScript will later be executed in the context of users browsing that forum, which may enable an attacker to steal cookies or misrepresent site content.

In addition, it has been reported that an attacker can inject arbitrary script into a signature file. However, Nessus has not tested for this issue.

The remote host runs Zeroboard, a web BBS application popular in Korea. 

The remote version of this software is vulnerable to cross-site scripting attacks due to a lack of sanitization of user-supplied data. Successful exploitation of this issue may allow an attacker to execute malicious script code in a user's browser within the context of the affected website.

According to its banner, the remote host is running a version of paNews that fails to sanitize input to the 'showpost' parameter of the 'comment.php' script before using it to generate dynamic web content. By coercing an unsuspecting user into visiting a malicious website, an attacker may be able to possibly steal credentials or execute browser-side code.

The installed version of OSCommerce is vulnerable to a cross-site scripting (XSS) attack.  An attacker, exploiting this flaw, would need to be able to coerce an unsuspecting user into visiting a malicious website.  Upon successful exploitation, the attacker would potentially be able to steal credentials or execute browser-side code.

The remote host is running Kayako eSupport, a web-based support and help desk application. 

This version of eSupport is vulnerable to a cross-site scripting flaw involving the 'nav' parameter of the 'index.php' script.  An attacker, exploiting this flaw, would need to be able to coerce an unsuspecting user into visiting a malicious website.  Upon successful exploitation, the attacker would be able to steal credentials or execute browser- side code.

The remote host is running at least one instance of Open WebMail that fails to sufficiently validate user input supplied to the 'logindomain' parameter.  This failure enables an attacker to run arbitrary script code in the context of a user's web browser.

The remote host is running SunShop, a web-based shopping cart program written in PHP.

The remote version of this software is vulnerable to several input validation flaws, which may allow an attacker to use the remote web site to perform a cross-site scripting attack.

The remote version of Claroline fails to sanitize user input to several parameters of the 'add_course.php' script.  Using a specially crafted URL, an attacker may be able to exploit this issue to perform cross-site scripting attacks against users of the affected application.

The remote host is running a version of ht://Dig which is vulnerable to an unspecified cross-site scripting attack. An attacker can exploit this flaw to steal information from unsuspecting users.

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on this host because of its failure to sanitize input to the 'return' and 'mos_change_template' parameters of the 'index.php' script.

There are flaws in the remote SmarterMail, a web mail interface.

This version of SmarterMail is affected by a cross-site scripting issue.  An attacker, exploiting this flaw, would be able to steal user credentials.

According to its banner, the remote version of vBulletin is earlier than 2.3.6 / 3.0.6.  Such versions are reportedly affected by a cross-site scripting issue involving its BB code parsing.  As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed.  This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

The remote host is running ExBB, a bulletin board system written in PHP.

According to its version number, this install of ExBB has a persistent cross-site scripting vulnerability.  Posting a maliciously crafted forum comment could lead to arbitrary script code execution.
A remote attacker could exploit this to steal the authentication cookies of legitimate users.

The remote host is running pLog, a blogging system written in PHP.

The remote version of this software does not perform a proper validation of user-supplied input and is, therefore, vulnerable to a cross-site scripting attack.

To exploit this flaw, an attacker would need to use the script 'register.php' to register a user profile containing HTML and script code as the attacker's name or blog.

Regular users of the remote website would then display the HTML and/or script code in their browser when visiting the page 'summary.php'.

The remote host runs Bugzilla, a web-based bug tracking system.

The remote Bugzilla installation, according to its version number, is vulnerable to a cross-site scripting attack when rendering internal errors containing user-supplied input.

The remote host is running BiTBOARD, a web-based bulletin board written in PHP. 

The remote version of this software is affected by a cross-site scripting issue that may allow an attacker to steal the http cookies of the regular users of the remote site to gain unauthorized access to their account.

The version of Gallery hosted on the remote web server is affected by a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to the 'username' parameter of the 'login.php' script.  An attacker could exploit this flaw to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site. 

Note that the application is reportedly affected by multiple additional cross-site scripting vulnerabilities as well as an information disclosure vulnerability, although Nessus has not tested for these.

The remote host is running Novell GroupWise WebAccess, a commercial groupware package.

The remote version of this software is affected by multiple cross-site scripting flaws due to a lack of sanitization of user-supplied data.

Successful exploitation of this issue may allow an attacker to use the remote server to perform an attack against a third-party user.

The remote host is running Siteman, a web-based content management system written in PHP.

The remote version of this software is vulnerable to a cross-site scripting attack due to a lack of sanitization of user-supplied data to the 'page' parameter of the 'forum.php' script.  Successful exploitation of this issue may allow an attacker to use the remote server to perform an attack against a third-party user.

The remote host is running at least one instance of Horde version 3.0, which suffers from two cross-site scripting vulnerabilities.
Through specially crafted GET requests to the remote host, an attacker can cause a third-party user to unknowingly run arbitrary JavaScript code.

The version of PhpGroupWare on the remote host is reportedly affected by HTML injection vulnerabilities that present themselves due to a lack of sufficient input validation performed on form fields used by PhpGroupWare modules.

A malicious attacker may exploit these issues to inject arbitrary HTML and script code using these form fields that then may be incorporated into dynamically-generated web content.

The MySQL Eventum install hosted on the remote web server is vulnerable to a cross-site scripting attack because it fails to sanitize user-supplied input to the 'email' parameter of the 'index.php' script before using it to generate dynamic HTML output.

With a specially crafted URL, an attacker can use the remote server to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.

Note that this install is also likely to be affected by several other similar cross-site scripting vulnerabilities, although Nessus has not checked for them.

The remote host runs YaCy, a peer-to-peer distributed web search engine and caching web proxy. 

The remote version of this software is vulnerable to multiple cross-site scripting due to a lack of sanitization of user-supplied data. 

Successful exploitation of this issue may allow an attacker to use the remote server to perform an attack against a third-party user.

The remote host is running the ArGoSoft WebMail interface.

There is a flaw in this interface that could allow an attacker to conduct cross-site scripting (XSS) attacks against users.
No further details have been provided.

*** Nessus solely relied on the banner of this service to issue
*** this alert.

The remote host seems to be running CVSTrac, a web-based bug and patch-set tracking system for CVS.

According to its version number, the remote installation of CVSTrac has multiple cross-site scripting flaws.  A remote attacker could exploit this by tricking a user into requesting a malicious URL, which would result in the execution of arbitrary script code as that user.

The remote host is using UseModWiki, a wiki CGI written in Perl. 

The CGI 'wiki.pl' is vulnerable to a cross-site-scripting issue that may allow attackers to steal the cookies of third parties.

There are various cross-site scripting issues in the remote version of this software.  An attacker may exploit them to use the remote website to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected website.

According to its banner, the remote version of PunBB is vulnerable to cross-site scripting attacks because the application does not validate URL and quote tags.  With a specially crafted URL, an attacker may be able to inject arbitrary HTML and script code into a user's browser, resulting in a loss of integrity.

According to its banner, the version of PunBB installed on the remote host fails to properly sanitize user input to the script 'profile.php'.  With a specially crafted URL, an attacker can inject arbitrary HTML and script code into a user's browser, resulting in a loss of integrity, theft of authentication cookies, and the like.

The remote version of PunBB is vulnerable to cross-site scripting flaws through 'install.php' script.  With a specially crafted URL, an attacker can inject arbitrary HTML and script code into a user's browser resulting in the possible theft of authentication cookies, mis-representation of site contents, and the like.

The remote version of PunBB is vulnerable to cross-site scripting flaws because the application does not validate the IMG tag.  With a specially crafted URL, an attacker can cause arbitrary code execution within a user's browser, resulting in a loss of integrity.

The remote version of Serendipity is vulnerable to cross-site scripting attacks due to a lack of sanity checks on the 'searchTerm' parameter in the 'compat.php' script.  With a specially crafted URL, an attacker can cause arbitrary code execution in a user's browser resulting in a loss of integrity.

The remote host is using Apache Jakarta Lucene, a full-featured text search engine library implemented in Java.

There is a cross-site scripting vulnerability in the script 'results.jsp' that may allow an attacker to steal the cookies of legitimate users on the remote host.

The remote host is using InMail/InShop, a web applications written in Perl.

An implementation error in the validation of the user input specifically in the script 'inmail.pl' in its 'acao' uri-argument and 'inshop.pl' in its 'screen' uri argument lead to an XSS vulnerability allowing a user to create cross-site attacks, also allowing theft of cookie-based authentication credentials.

The remote host is using the YaBB web forum software. 

According to its version number, the remote version of this software is vulnerable to JavaScript injection issues using shadow or glow tags.  This may allow an attacker to inject hostile JavaScript into the forum system, to steal cookie credentials or misrepresent site content.  When the form is submitted the malicious JavaScript will be incorporated into dynamically-generated content.

The remote host runs phpCMS, a content management system written in PHP.

This version is vulnerable to cross-site scripting due to a lack of sanitization of user-supplied data in parser.php script. Successful exploitation of this issue may allow an attacker to execute malicious script code on a vulnerable server.

The remote host is using Aztek Forum, a web forum written in PHP. 

A vulnerability exists the remote version of this software - more specifically in the script 'forum_2.php', that may allow an attacker to set up a cross-site scripting attack using the remote host.

The version of phpMyAdmin installed on the remote host is vulnerable to cross-site scripting attacks through various parameters and scripts.  With a specially crafted URL, an attacker can cause arbitrary code execution resulting in a loss of integrity.

The remote host is running TikiWiki, a content management system written in PHP.

The version of this software running on the remote host has a cross-site scripting vulnerability in tiki-error.php.  A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL, resulting in the execution of arbitrary script code.

The remote host runs Teekai Tracking Online, a PHP script used for tracking the number of users on a Web site.  This version is vulnerable to cross-site scripting attacks.  A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL, resulting in the execution of arbitrary code.

The 'htsearch' CGI, which is part of the ht://Dig package, is vulnerable to cross-site scripting attacks, through the 'words' variable.

With a specially crafted URL, an attacker can cause arbitrary code execution resulting in a loss of integrity.

TIPS MailPost, a web application used for emailing HTML form data to a third party, is installed on the remote host. 

The version of MailPost hosted on the remote web server has a cross-site scripting vulnerability in the 'append' variable of mailpost.exe when debug mode is enabled.  Debug mode is enabled by default.  A remote attacker could exploit this to impersonate legitimate users. 

This version of MailPost reportedly has other vulnerabilities, though Nessus has not checked for those issues.

The remote host is running Cherokee - a fast and tiny web server.

The remote version of this software is vulnerable to cross-site scripting attacks due to lack of sanitization in returned error pages.

The remote host is running at least one instance of Horde IMP in which the 'status.php3' script is vulnerable to a cross-site scripting attack since information passed to it is not properly sanitized.

The target is running at least one instance of Horde in which the help subsystem is vulnerable to a cross-site scripting attack since information passed to the help window is not properly sanitized.

The remote host seems to be running MoniWiki, a wiki web application written in PHP.

The remote version of this software is vulnerable to cross-site scripting attacks, through the script 'wiki.php'.

With a specially crafted URL, an attacker can cause arbitrary code execution in users' browsers resulting in a loss of integrity.

ID	Name	Severity
17302	PHP-Fusion BBCode IMG Tag XSS	medium
17256	CuteNews <= 1.3.6 Multiple XSS	low
17226	Verity Ultraseek Search Request XSS	medium
17220	phpMyAdmin < 2.6.1 pl2 Libraries and Themes Multiple XSS	medium
17202	Invision Power Board COLOR SML Tag XSS	low
17199	Zeroboard < 4.1pl6 Multiple XSS	medium
16479	paNews comment.php showpost Parameter XSS	medium
16476	osCommerce contact_us.php enquiry Parameter XSS	medium
16474	Kayako eSupport index.php nav Parameter XSS	medium
16463	Open WebMail openwebmail.pl logindomain Parameter XSS	medium
16322	SunShop Shopping Cart index.php search Parameter XSS	medium
16318	Claroline add_course.php Multiple Parameter XSS	medium
16317	ht://Dig htsearch.cgi config Parameter XSS	medium
16316	Mambo Site Server mos_change_template XSS	medium
16281	SmarterTools SmarterMail Attachment Upload XSS	medium
16280	vBulletin BB Tag XSS	low
16223	ExBB Netsted BBcode XSS	low
16207	pLog register.php Multiple Parameter XSS	medium
16206	Bugzilla Internal Error Response XSS	medium
16191	BiTBOARD IMG BBCode Tag XSS	low
16185	Gallery login.php username Parameter XSS	medium
16174	Novell GroupWise 6.5.3 WebAccess Multiple XSS	medium
16171	Siteman forum.php page Parameter XSS	medium
16162	Horde < 3.0.1 Multiple Script XSS	medium
16138	phpGroupWare index.php Calendar Date XSS	medium
16093	MySQL Eventum index.php email Parameter XSS	medium
16058	YaCy Peer-To-Peer Search Engine XSS	medium
16012	ArGoSoft Mail Server Unspecified XSS	medium
16000	CVSTrac < 1.1.5 Multiple XSS	medium
15967	UseModWiki wiki.pl XSS	medium
15951	UBB.threads < 6.5.1 Multiple XSS	medium
15941	PunBB URL Quote Tag XSS	medium
15940	PunBB profile.php XSS	medium
15939	PunBB < 1.1.2 install.php XSS	medium
15937	PunBB IMG Tag Client Side Scripting XSS	medium
15914	Serendipity compat.php searchTerm Parameter XSS	medium
15908	Apache Jakarta Lucene results.jsp XSS	medium
15864	InMail/InShop inmail.pl / inshop.pl XSS	medium
15859	YaBB Shadow BBCode Tag XSS	medium
15850	phpCMS parser.php file Parameter XSS	medium
15785	Aztek Forum Multiple Script XSS	medium
15770	phpMyAdmin < 2.6.0-pl3 Multiple XSS	medium
15709	TikiWiki tiki-error.php XSS	medium
15707	TeeKai Tracking Online XSS	medium
15706	ht://Dig htsearch.cgi words Parameter XSS	medium
15626	TIPS MailPost append Parameter XSS	medium
15618	Cherokee Web Server Error Page XSS	medium
15616	Horde IMP status.php3 script Parameter XSS	medium
15605	Horde Application Framework Help Window Multiple Parameter XSS	medium
15566	MoniWiki < 1.0.9 wiki.php XSS	medium

Detections

Analytics

CGI abuses : XSS Family for Nessus

medium

low

medium

medium

low

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

low

low

medium

medium

low

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium