bugtraq - RE: Cobalt RaQ Control Panel Cross Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <91746143E3B6E9469DBBFF9228B5FDDC02F7EC@srv2kw3exchng.entrenchtech.com>
Date: Sat, 4 Oct 2003 19:04:18 -0600
From: "Steve  Manzuik" <steve@...renchtech.com>
To: "Lorenzo Hernandez Garcia-Hierro" <lorenzohgh@...g-security.com>,
	"Bugtraq" <bugtraq@...urityfocus.com>
Subject: RE: Cobalt RaQ Control Panel Cross Site Scripting

> it is a security hole because it demonstrates that the message.cgi script
> does not have
> an input validation system.

This isn't a security hole but more of a scripting mistake.  You don't gain any additional access, you don't r00t the box, you don't even steal another users session.  Common best practices would tell anyone worth their wage to enable SSL and not allow access to TCP 444 (the control panel interface default port) to the outside anyways.

I fail to see how there is anything exploitable here.

-S