[Full-Disclosure] Plesk 7 Cross-Site Scripting

From: Andrew Smith (stfunub_at_gmail.com)
Date: 12/23/04

  • Next message: n3td3v: "Re: [Full-Disclosure] This sums up Yahoo!s security policy to a -T-" 
    Date: Thu, 23 Dec 2004 22:58:05 +0000
To: dailydave@immunitysec.com, full-disclosure@lists.netsys.com, bugtraq@securityfocus.com, Secunia Research <vuln@secunia.com>, OSVDB <moderators@osvdb.org>

    Vendor: SW-Soft

    URL: http://www.sw-soft.com/

    Version: Plesk 7.0.0

    Risk: Cross-Site Scripting

    Description: Plesk is comprehensive server management software
    developed specifically for the Hosting Service Industry with the
    assistance of Web hosting professionals. Time tested tough in real
    world hosting environments this award winning "control panel" software
    has proven itself for years to be simply the best.
    Cross Site Scripting:
    There's a cross-site scripting vulnerability in the login page for
    Plesk 7, another case of improperly secured POST data.
    An attacker can inject data into the page through the login_name
    variable on the login page ("login_up.php3").
    An example can be found here: http://www.wheresthebeef.co.uk/XSS/plesk.7.html
    The CSS isn't done through a GET request, it is done through POST and
    can be exploited in the form of a form.

    Solution:
    The vendor hasn't replied to any of my e-mails but they do appear to
    have fixed this problem.
    *Hello SW-Soft, if you're watching!* 

    -- 
zxy_rbt2
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: n3td3v: "Re: [Full-Disclosure] This sums up Yahoo!s security policy to a -T-"

    Relevant Pages