FloosieTek FTGatePro 1.22 Mail Server Cross-Site Scripting Vulnerability

2003-09-02T00:00:00
ID EDB-ID:23092
Type exploitdb
Reporter Ziv Kamir
Modified 2003-09-02T00:00:00

Description

FloosieTek FTGatePro 1.22 Mail Server Cross-Site Scripting Vulnerability. Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/8528/info

FloosieTek FTGatePro Mail Server is prone to a cross-site scripting vulnerability. A remote attacker could exploit this issue by enticing a legitimate user of the mail server to follow a malicious link with embedded HTML and script code. The attacker-supplied code would potentially be rendered in the user's browser when the link is followed.

This issue exists in the web administrative interface, which listens on port 8089 by default. 

http://www.example.com:8089/help/index.fts?href=<script>alert('C.S.S')</script>