Metasploit 4.1.0 Web UI stored XSS Vulnerability

ID SSV:72251
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.

                                                Advisory:              		Metasploit 4.1.0 Web UI stored XSS vulnerability
Advisory ID:           	SSCHADV2011-033
Author:                		Stefan Schurtz
Affected Software:  	Successfully tested on Metasploit Community Edition
Vendor URL: 
Vendor Status:       	informed

Vulnerability Description:

Metasploit 4.1.0 Web UI "project[name]" parameter is prone to a XSS vulnerability

Technical Details:

Login to Web UI -> Create New Project -> Project name -> '"</script><script>alert(document.cookie)</script>


Vulnerability found and advisory written by Stefan Schurtz.

XSS is fixed in Update 20111020000001