bugtraq - APC Switched Rack PDU XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200912142119.nBELJ4pn010636@www3.securityfocus.com>
Date: Mon, 14 Dec 2009 14:19:04 -0700
From: jpecou@...il.com
To: bugtraq@...urityfocus.com
Subject: APC Switched Rack PDU XSS Vulnerability

###########################################

#APC Switched Rack PDU XSS Vulnerability#
#By Jamal Pecou #
#jpecou (at) gmail (dot) c0m. #

###############Product Info#################

		#Product Info(Tested Versions)#
Model = AP7932
Harware Revision = B2

		#Application Module#
Name = rpdu
Version = v3.3.3(Tested First) 
Version = 3.7.0(Current)

		#APC OS (AOS)
Name = aos
Version = v3.3.4

###############Vulnerability################

XSS Vulnerability:

The APC Switch RACK PDU web administration login page is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. 

The script "login1" located in the Forms directory fails to properly sanitize user input data in the login_username field

####################PoC#####################

Proof-of-Concept

http://<PDU IP>/Forms/login1?login_username=<ScRiPt>alert('hello');</ScRiPt>


################Additional#################

Jun 17th 2009 - Vulnerability Discovered

Jun 18th 2009 - Contacted Vendor

Jun 21st 2009 - APC Creates a ticket and enters finding into bug tracking database.

Dec 14th 2009 - APC, no patches released.

###########################################