Detections
Analytics
WebChat XSS
medium Nessus Plugin ID 11470
Language:
Synopsis
The remote CGI is vulnerable to an injection attack.Description
The remote host is vulnerable to a cross-site scripting attack through its web chat module :- An attacker may create a new user with a bogus email address containing JavaScript code
- Then the profile of the newly created user or the 'lost password' page for this user will display the unprocessed JavaScript to the user
An attacker may use this flaw to steal the cookies of your regular users.
Solution
None at this time, but see the following website for additional information: http://www.nessus.org/u?d8323071.See Also
Plugin Details
Severity: Medium
ID: 11470
File Name: web_chat_xss.nasl
Version: 1.26
Type: remote
Family: CGI abuses : XSS
Published: 3/25/2003
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Reference Information
BID: 7190