Working Resources BadBlue 1.7 EXT.DLL Cross-Site Scripting Vulnerability

2002-06-23T00:00:00
ID EDB-ID:21576
Type exploitdb
Reporter Matthew Murphy
Modified 2002-06-23T00:00:00

Description

Working Resources BadBlue 1.7 EXT.DLL Cross Site Scripting Vulnerability. CVE-2002-1685. Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/5086/info

BadBlue is a P2P file sharing application distributed by Working Resources. The ext.dll ISAPI does not sufficiently sanitize input. Because of this, it is possible for a user to create a custom URL containing script code that, when viewed in a browser by another user, will result in the execution of the script code. This could allow for the execution of malicious JavaScript in the context of a trusted site. 

http://target/ext.dll?MfcISAPICommand=LoadPage&page=search.htx&a0=%3Cscript%3Ealert('lame')%3C/script%3E&a1=0&a2=1&a3=6