Resin Application Server 4.0.36 Cross Site Scripting

`  
Resin Application Server 4.0.36 Cross-Site Scripting Vulnerabilities  
  
  
Vendor: Caucho Technology, Inc.  
Product web page: http://www.caucho.com  
Affected version: Resin Professional Web And Application Server 4.0.36  
  
Summary: Resin is the Java Application Server for high traffic  
sites that require speed and scalability. It is one of the earliest  
Java Application Servers, and has stood the test of time due to  
engineering prowess.  
  
Desc: Resin Application and Web Server The plugin suffers from a XSS  
issue due to a failure to properly sanitize user-supplied input to  
the 'logout' GET parameter in the 'index.php' script. URI-based XSS  
issue is also present and both of the vulnerabilities can be triggered  
once the user/admin is logged in (post-auth). Attackers can exploit  
this weakness to execute arbitrary HTML and script code in a user's  
browser session.  
  
Tested on: Resin Professional 4.0.36 (built Fri, 26 Apr 2013 03:33:09 PDT)  
Java HotSpot(TM) 64-Bit Server VM 23.3-b01  
4 cpu, Windows 7 amd64 6.1  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2013-5143  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5143.php  
  
  
01.06.2013  
  
--  
  
  
http://127.0.0.1:8080/resin-admin/?q=index.php&logout=true%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E  
http://127.0.0.1:8080/resin-admin\?%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E  
`