ECHO-C7FC-C3BE-23F2

Bulletin has no description...

NetWin SurgeFTP 23f2 Cross Site Scripting Vulnerability

NetWin SurgeFTP version 23f2 suffers from multiple persistent cross site scripting vulnerabilities. Exploit Title: Multiple stored Cross-site scripting in NetWin SurgeFTP version 23f2 CVE: CVE-2017-17933 Date: 27-12-2017 Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr...

CVE-2017-17933

NetWin SurgeFTP 23f2 contains a stored cross-site scripting (XSS) flaw in the Web Manager CGI at cgi/surgeftpmgr.cgi (ports 7021/9021). The vulnerability arises from insufficient input filtering for the classid, domainid, and username parameters, enabling an attacker to inject malicious scripts. ...