Microsoft Indexing Service - Query Validation Cross-Site Scripting
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | Update Protection against Indexing Service Cross-Site Scripting Vulnerability (MS06-053) | 14 Sep 200600:00 | – | checkpoint_advisories |
 | CVE-2006-0032 | 12 Sep 200623:00 | – | cve |
 | CVE-2006-0032 | 12 Sep 200623:00 | – | cvelist |
 | JVN#52201480 Microsoft Windows Indexing Service cross-site scripting vulnerability | 13 Sep 200600:00 | – | jvn |
| Microsoft Windows Indexing Service cross-site scripting vulnerability | 20 May 200815:00 | – | jvn |
 | CVE-2006-0032 | 12 Sep 200623:07 | – | nvd |
 | Cross site scripting | 12 Sep 200623:07 | – | prion |
 | Microsoft Security Bulletin MS06-053 Vulnerability in Indexing Service Could Allow Cross-Site Scripting (920685) | 12 Sep 200600:00 | – | securityvulns |
 | MS06-053: Vulnerability in Indexing Service Could Allow XSS (920685) | 12 Sep 200600:00 | – | nessus |
 | Microsoft Indexing Services vulnerable to cross-site scripting | 12 Sep 200600:00 | – | cert |
10
source: https://www.securityfocus.com/bid/19927/info
Microsoft Indexing Service is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input before it is rendered to other users.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user, in the context of the victim's session. This could allow the attacker to perform actions on behalf of the victim, such as spoofing content or hijacking their session.
Microsoft Indexing Service is not installed or enabled by default. Even if installed, it is not accessible from Internet Information Services (IIS). This vulnerability affects only systems that have IIS and Indexing Service installed and that have the Indexing Service configured to be accessible from IIS through a web-based interface.
http://www.example.com/+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-.htw?CiWebHitsFile=/iisstart.asp&CiRestriction=''
http://www.example.com/+ADw-SCRIPT+AD4-alert('XSS');+ADw-+AC8-SCRIPT+AD4-.ida
UTF-7("<") = +ADw-, +ADx-, +ADy-, +ADz-
UTF-7(">") = +AD4-, +AD5-, +AD6-, +AD7-
UTF-7("/") = +AC8-, +AC9-Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
24 Sep 2013 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 24.3
EPSS0.23241