Critical Path InJoin Directory Server 4.0 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/4717/info

Critical Path provides an LDAP (Lightweight Directory Access Protocol) Directory Server called InJoin. InJoin Directory is provided for Microsoft Windows operating systems and Unix variants.

HTML code is not filtered from URL parameters that are used as output in the web-based administrative interface. This enables an attacker to inject malicious script code into a link to the administrative interface. When this link is visited by an authenticated administrative user, the attacker's script code will be executed in the browser of that user, in the security context of the site running the interface.

Successful exploitation may allow the attacker to steal cookie-based authentication credentials from the administrative user.

http://ip:1500/DSASD&DSA=1&LOCID=<script>^Ã?.</script>&FRAME=Y
http://ip:1500/OBCR&OC=<script>^Ã?.</script>&FRAME=Y