http://www.dsecrg.com/pages/vul/show.php?id=122
Digital Security Research Group [DSecRG] Advisory #DSECRG-09-022
Application: Adobe Coldfusion 8
Versions Affected: Adobe Coldfusion 8
Vendor URL: http://adobe.com
Bugs: Multiple Linked XSS,XSRF
Exploits: YES
Reported: 12.01.2009
Vendor response: 13.01.2009
Date of Public Advisory: 17.08.2009
CVE-number: CVE-2009-1872
Author: Alexander Polyakov
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)
Description
Multiple Linked XSS and XSRF vulnerabilities found in Adobe Coldfusion Server 8. Attacker can create evil link and steal administrators cookie
Details
1.1 Linked XSS vulnerability found in script searchlog.cfm. vulnerable parameter startRow
Example
1.2 Linked XSS vulnerability found in script _logintowizard.cfm. Attacker can inject XSS in url string
Example
1.3 Linked XSS vulnerability found in script _authenticatewizarduser.cfm. Attacker can inject XSS in url string
Example
1.4 Linked XSS vulnerability found in script _authenticatewizarduser.cfm.Attacker can inject XSS in url string
Example
Fix Information
The issue has been solved 17 august 2009. http://www.adobe.com/go/apsb09-12
References:
http://www.adobe.com/go/apsb09-12
http://www.dsecrg.com/pages/vul/show.php?id=122
About
Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.
Contact: research [at] dsecrg [dot] com
http://www.dsecrg.com
β
Π‘ ΡΠ²Π°ΠΆΠ΅Π½ΠΈΠ΅ΠΌ,
research mailto:[email protected]