Cisco Secure ACS for Windows NT 3.0 - Cross-Site Scripting

2002-06-14T00:00:00
ID EXPLOITPACK:3A71B0B12E8DF57F5F030640BF21BEF2
Type exploitpack
Reporter Dave Palumbo
Modified 2002-06-14T00:00:00

Description

Cisco Secure ACS for Windows NT 3.0 - Cross-Site Scripting

                                        
                                            source: https://www.securityfocus.com/bid/5026/info

Cisco Secure ACS is an access control and accounting server system. It is distributed and maintained by Cisco, and in this vulnerability affects implementations on the Microsoft Windows NT platform.

It has been discovered that the web server component of the Cisco Secure ACS package allows an attacker to execute cross-site scripting attacks. When this link is visited, the attacker-supplied HTML or script code could be executed in the browser of a user, provided the user has authenticated to the Secure ACS server. 

http://example.com:dyn_port/setup.exe?action=<script>alert('foo+bar')</script>&page=list_users&user=P*