9 lines
No EOL
931 B
Text
9 lines
No EOL
931 B
Text
source: http://www.securityfocus.com/bid/8908/info
|
|
|
|
It has been reported that a cross-site scripting vulnerability may exist in NetFile that may allow remote attackers to execute HTML or script code in a user's browser. The issue is reported to occur due to a "404 Not Found" error message returned to the user due to a request for a URL that does not exist. The error message reportedly contains the bad URL which is not properly sanitized therefore allowing an attacker to a construct a malicious link containing HTML or script code that may be rendered in a user's browser.
|
|
|
|
Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.
|
|
|
|
NetFile FTP/Webserver Version 6.0.3.588 has been reported to be prone to this issue, however other versions may be affected as well.
|
|
|
|
http://www.example.com/<script>alert("bang")</script> |