The installed version of phpMyAdmin suffers from a cross-site scripting vulnerability due to its failure to sanitize user input to the 'convcharset' parameter of the 'index.php' script.  A remote attacker may use these vulnerabilities to cause arbitrary code to be executed in a user's browser to steal authentication cookies and the like.

According to its banner, the version of Mailreader installed on the remote host is affected by a remote HTML injection vulnerability due to its failure to properly sanitize messages using a 'text/enriched' or 'text/richtext' MIME type.  An attacker can exploit this flaw by sending a specially crafted message to a user who reads his mail with Mailreader.  Then, when the user reads that message, malicious HTML or script code embedded in the message will be run by the user's browser in the context of the remote host, enabling the attacker to steal authentication cookies as well as perform other attacks.

The version of Horde installed on the remote host suffers from a cross-site scripting vulnerability in which an attacker can inject arbitrary HTML and script code via the page title of a parent frame, enabling him to steal cookie-based authentication credentials and perform other such attacks.

The version of CPG Dragonfly / CPG-Nuke CMS installed on the remote host suffers from multiple cross-site scripting vulnerabilities due to its failure to sanitize user-input to several variables in various modules.  An attacker can exploit these flaws to steal cookie-based authentication credentials and perform other such attacks.

The version of phpMyDirectory installed on the remote host suffers from multiple cross-site scripting vulnerabilities due to its failure to sanitize user input to its 'review.php' script through various parameters.  A remote attacker can exploit these flaws to steal cookie-based authentication credentials and perform other such attacks.

The remote host is running phpSysInfo, a PHP script that parses the /proc entries on Linux systems and displays them in HTML. 

The version of phpSysInfo installed on the remote host is affected by multiple cross-site scripting vulnerabilities due to its failure to sanitize user input to the 'sensor_program' parameter of 'index.php' and the 'text[language]', 'text[template]', and 'VERSION' parameters of 'system_footer.php'.  If PHP's 'register_globals' setting is enabled, a remote attacker can exploit these flaws to have arbitrary script rendered in the browser of a user in the context of the affected website.

The version of Invision Power Board installed on the remote host does not properly sanitize HTML tags, which enables a remote attacker to inject a malicious IFRAME when posting a message to one of the hosted forums.  This could cause arbitrary HTML and script code to be executed in the context of users browsing the forum, which could allow an attacker to steal cookies or misrepresent site content.

The version of Kayako eSupport installed on the remote host is subject to multiple cross-site scripting vulnerabilities in the script 'index.php' through the parameters '_i' and '_c'.  These issues may allow an attacker to inject HTML and script code into a user's browser within the context of the remote site, enabling him to steal authentication cookies, access data recently submitted by the user, and the like.

According to its banner, the version of PunBB installed on the remote host fails to properly sanitize user input to the script 'profile.php' through the 'email' and 'Jabber' parameters.  An attacker could exploit this flaw to embed malicious script or HTML code in his profile.  Then, whenever someone browses that profile, the code would be executed in that person's browser in the context of the website, enabling the attacker to conduct cross-site scripting attacks.

The version of Phorum installed on the remote host is prone to multiple cross-site scripting vulnerabilities due to its failure to sanitize user input.  An attacker can exploit these flaws to potentially cause arbitrary script and HTML code to be rendered by a user's browser in the context of the vulnerable site.

The remote host is running paBox, a web application written in PHP. 

The remote version of paBox installed on the remote host does not properly sanitize input supplied through the 'posticon' parameter used to select a 'smilie' for a post.  By exploiting this flaw, an attacker can inject HTML and script code into the browser of users who view the affected post, potentially stealing authentication cookies and controlling how the affected application is rendered.

The installed version of YaBB (Yet Another Bulletin Board) on the remote host suffers from a remote cross-site scripting flaw due to its failure to properly sanitize input passed via the 'username' parameter and used as part of the 'usersrecentposts' action.  By exploiting this flaw, a remote attacker can cause arbitrary code to be executed in a user's browser in the context of the affected website, resulting in the theft of authentication data or other such attacks.

The remote host is running a version of PHP-Fusion that does not sufficiently sanitize JavaScript code.  Specifically, an attacker can inject JavaScript code that bypasses the filters in 'fusion_core.php' by HTML-encoding it.  This code will then be executed in the context of a user's browser when viewing the malicious BBcode on the remote host.

According to its version number, the remote host is running a version of CuteNews that allows an attacker to inject arbitrary script through the variables 'X-FORWARDED-FOR' or 'CLIENT-IP' when adding a comment. On one hand, an attacker can inject a client-side script to be executed by an administrator's browser when he/she chooses to edit the added comment.  On the other, an attacker with local access could leverage this flaw to run arbitrary PHP code in the context of the web server user. 

Additionally, it suffers from a cross-site scripting flaw involving the 'search.php' script.

The remote host is running Ultraseek, an enterprise search engine. This version has a cross-site scripting vulnerability.  Successful exploitation of this issue may allow an attacker to execute malicious script code on a vulnerable server.

The installed version of phpMyAdmin suffers from multiple cross-site scripting vulnerabilities due to its failure to sanitize user input in several PHP scripts used as libraries and themes.  A remote attacker may use these issues to cause arbitrary code to be executed in a user's browser, to steal authentication cookies and the like.

According to the version number in its banner, the installation of Invision Power Board on the remote host reportedly does not sufficiently sanitize the 'COLOR' SML tag. A remote attacker may exploit this vulnerability by adding a specially crafted 'COLOR' tag with arbitrary JavaScript to any signature or post on an Invision board. That JavaScript will later be executed in the context of users browsing that forum, which may enable an attacker to steal cookies or misrepresent site content.

In addition, it has been reported that an attacker can inject arbitrary script into a signature file. However, Nessus has not tested for this issue.

The remote host runs Zeroboard, a web BBS application popular in Korea. 

The remote version of this software is vulnerable to cross-site scripting attacks due to a lack of sanitization of user-supplied data. Successful exploitation of this issue may allow an attacker to execute malicious script code in a user's browser within the context of the affected website.

According to its banner, the remote host is running a version of paNews that fails to sanitize input to the 'showpost' parameter of the 'comment.php' script before using it to generate dynamic web content. By coercing an unsuspecting user into visiting a malicious website, an attacker may be able to possibly steal credentials or execute browser-side code.

The installed version of OSCommerce is vulnerable to a cross-site scripting (XSS) attack.  An attacker, exploiting this flaw, would need to be able to coerce an unsuspecting user into visiting a malicious website.  Upon successful exploitation, the attacker would potentially be able to steal credentials or execute browser-side code.

The remote host is running Kayako eSupport, a web-based support and help desk application. 

This version of eSupport is vulnerable to a cross-site scripting flaw involving the 'nav' parameter of the 'index.php' script.  An attacker, exploiting this flaw, would need to be able to coerce an unsuspecting user into visiting a malicious website.  Upon successful exploitation, the attacker would be able to steal credentials or execute browser- side code.

The remote host is running at least one instance of Open WebMail that fails to sufficiently validate user input supplied to the 'logindomain' parameter.  This failure enables an attacker to run arbitrary script code in the context of a user's web browser.

The remote host is running SunShop, a web-based shopping cart program written in PHP.

The remote version of this software is vulnerable to several input validation flaws, which may allow an attacker to use the remote web site to perform a cross-site scripting attack.

The remote version of Claroline fails to sanitize user input to several parameters of the 'add_course.php' script.  Using a specially crafted URL, an attacker may be able to exploit this issue to perform cross-site scripting attacks against users of the affected application.

The remote host is running a version of ht://Dig which is vulnerable to an unspecified cross-site scripting attack. An attacker can exploit this flaw to steal information from unsuspecting users.

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on this host because of its failure to sanitize input to the 'return' and 'mos_change_template' parameters of the 'index.php' script.

There are flaws in the remote SmarterMail, a web mail interface.

This version of SmarterMail is affected by a cross-site scripting issue.  An attacker, exploiting this flaw, would be able to steal user credentials.

According to its banner, the remote version of vBulletin is earlier than 2.3.6 / 3.0.6.  Such versions are reportedly affected by a cross-site scripting issue involving its BB code parsing.  As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed.  This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

The remote host is running ExBB, a bulletin board system written in PHP.

According to its version number, this install of ExBB has a persistent cross-site scripting vulnerability.  Posting a maliciously crafted forum comment could lead to arbitrary script code execution.
A remote attacker could exploit this to steal the authentication cookies of legitimate users.

The remote host is running pLog, a blogging system written in PHP.

The remote version of this software does not perform a proper validation of user-supplied input and is, therefore, vulnerable to a cross-site scripting attack.

To exploit this flaw, an attacker would need to use the script 'register.php' to register a user profile containing HTML and script code as the attacker's name or blog.

Regular users of the remote website would then display the HTML and/or script code in their browser when visiting the page 'summary.php'.

The remote host runs Bugzilla, a web-based bug tracking system.

The remote Bugzilla installation, according to its version number, is vulnerable to a cross-site scripting attack when rendering internal errors containing user-supplied input.

The remote host is running BiTBOARD, a web-based bulletin board written in PHP. 

The remote version of this software is affected by a cross-site scripting issue that may allow an attacker to steal the http cookies of the regular users of the remote site to gain unauthorized access to their account.

The version of Gallery hosted on the remote web server is affected by a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to the 'username' parameter of the 'login.php' script.  An attacker could exploit this flaw to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site. 

Note that the application is reportedly affected by multiple additional cross-site scripting vulnerabilities as well as an information disclosure vulnerability, although Nessus has not tested for these.

The remote host is running Novell GroupWise WebAccess, a commercial groupware package.

The remote version of this software is affected by multiple cross-site scripting flaws due to a lack of sanitization of user-supplied data.

Successful exploitation of this issue may allow an attacker to use the remote server to perform an attack against a third-party user.

The remote host is running Siteman, a web-based content management system written in PHP.

The remote version of this software is vulnerable to a cross-site scripting attack due to a lack of sanitization of user-supplied data to the 'page' parameter of the 'forum.php' script.  Successful exploitation of this issue may allow an attacker to use the remote server to perform an attack against a third-party user.

The remote host is running at least one instance of Horde version 3.0, which suffers from two cross-site scripting vulnerabilities.
Through specially crafted GET requests to the remote host, an attacker can cause a third-party user to unknowingly run arbitrary JavaScript code.

The version of PhpGroupWare on the remote host is reportedly affected by HTML injection vulnerabilities that present themselves due to a lack of sufficient input validation performed on form fields used by PhpGroupWare modules.

A malicious attacker may exploit these issues to inject arbitrary HTML and script code using these form fields that then may be incorporated into dynamically-generated web content.

The MySQL Eventum install hosted on the remote web server is vulnerable to a cross-site scripting attack because it fails to sanitize user-supplied input to the 'email' parameter of the 'index.php' script before using it to generate dynamic HTML output.

With a specially crafted URL, an attacker can use the remote server to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.

Note that this install is also likely to be affected by several other similar cross-site scripting vulnerabilities, although Nessus has not checked for them.

The remote host runs YaCy, a peer-to-peer distributed web search engine and caching web proxy. 

The remote version of this software is vulnerable to multiple cross-site scripting due to a lack of sanitization of user-supplied data. 

Successful exploitation of this issue may allow an attacker to use the remote server to perform an attack against a third-party user.

The remote host is running the ArGoSoft WebMail interface.

There is a flaw in this interface that could allow an attacker to conduct cross-site scripting (XSS) attacks against users.
No further details have been provided.

*** Nessus solely relied on the banner of this service to issue
*** this alert.

The remote host seems to be running CVSTrac, a web-based bug and patch-set tracking system for CVS.

According to its version number, the remote installation of CVSTrac has multiple cross-site scripting flaws.  A remote attacker could exploit this by tricking a user into requesting a malicious URL, which would result in the execution of arbitrary script code as that user.

The remote host is using UseModWiki, a wiki CGI written in Perl. 

The CGI 'wiki.pl' is vulnerable to a cross-site-scripting issue that may allow attackers to steal the cookies of third parties.

There are various cross-site scripting issues in the remote version of this software.  An attacker may exploit them to use the remote website to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected website.

According to its banner, the remote version of PunBB is vulnerable to cross-site scripting attacks because the application does not validate URL and quote tags.  With a specially crafted URL, an attacker may be able to inject arbitrary HTML and script code into a user's browser, resulting in a loss of integrity.

According to its banner, the version of PunBB installed on the remote host fails to properly sanitize user input to the script 'profile.php'.  With a specially crafted URL, an attacker can inject arbitrary HTML and script code into a user's browser, resulting in a loss of integrity, theft of authentication cookies, and the like.

The remote version of PunBB is vulnerable to cross-site scripting flaws through 'install.php' script.  With a specially crafted URL, an attacker can inject arbitrary HTML and script code into a user's browser resulting in the possible theft of authentication cookies, mis-representation of site contents, and the like.

The remote version of PunBB is vulnerable to cross-site scripting flaws because the application does not validate the IMG tag.  With a specially crafted URL, an attacker can cause arbitrary code execution within a user's browser, resulting in a loss of integrity.

The remote version of Serendipity is vulnerable to cross-site scripting attacks due to a lack of sanity checks on the 'searchTerm' parameter in the 'compat.php' script.  With a specially crafted URL, an attacker can cause arbitrary code execution in a user's browser resulting in a loss of integrity.

The remote host is using Apache Jakarta Lucene, a full-featured text search engine library implemented in Java.

There is a cross-site scripting vulnerability in the script 'results.jsp' that may allow an attacker to steal the cookies of legitimate users on the remote host.

The remote host is using InMail/InShop, a web applications written in Perl.

An implementation error in the validation of the user input specifically in the script 'inmail.pl' in its 'acao' uri-argument and 'inshop.pl' in its 'screen' uri argument lead to an XSS vulnerability allowing a user to create cross-site attacks, also allowing theft of cookie-based authentication credentials.

ID	Name	Severity
17689	phpMyAdmin index.php convcharset Parameter XSS	medium
17661	Mailreader network.cgi enriched/richtext MIME Message XSS	medium
17650	Horde Parent Frame Page Title XSS	medium
17647	CPG Dragonfly Multiple XSS	medium
17634	phpMyDirectory review.php subcat Parameter XSS	medium
17610	PHPSysInfo < 2.5 Multiple Script XSS	medium
17609	Invision Power Board HTTP POST Request IFRAME Tag XSS	low
17598	Kayako eSupport Troubleshooter Module index.php Multiple Parameter XSS	medium
17363	PunBB profile.php Multiple Parameter XSS	medium
17350	Phorum < 5.0.15 Multiple XSS	medium
17336	paBox pabox.php posticon Parameter XSS	medium
17305	YaBB YaBB.pl usersrecentposts Action username Parameter XSS	medium
17302	PHP-Fusion BBCode IMG Tag XSS	medium
17256	CuteNews <= 1.3.6 Multiple XSS	low
17226	Verity Ultraseek Search Request XSS	medium
17220	phpMyAdmin < 2.6.1 pl2 Libraries and Themes Multiple XSS	medium
17202	Invision Power Board COLOR SML Tag XSS	low
17199	Zeroboard < 4.1pl6 Multiple XSS	medium
16479	paNews comment.php showpost Parameter XSS	medium
16476	osCommerce contact_us.php enquiry Parameter XSS	medium
16474	Kayako eSupport index.php nav Parameter XSS	medium
16463	Open WebMail openwebmail.pl logindomain Parameter XSS	medium
16322	SunShop Shopping Cart index.php search Parameter XSS	medium
16318	Claroline add_course.php Multiple Parameter XSS	medium
16317	ht://Dig htsearch.cgi config Parameter XSS	medium
16316	Mambo Site Server mos_change_template XSS	medium
16281	SmarterTools SmarterMail Attachment Upload XSS	medium
16280	vBulletin BB Tag XSS	low
16223	ExBB Netsted BBcode XSS	low
16207	pLog register.php Multiple Parameter XSS	medium
16206	Bugzilla Internal Error Response XSS	medium
16191	BiTBOARD IMG BBCode Tag XSS	low
16185	Gallery login.php username Parameter XSS	medium
16174	Novell GroupWise 6.5.3 WebAccess Multiple XSS	medium
16171	Siteman forum.php page Parameter XSS	medium
16162	Horde < 3.0.1 Multiple Script XSS	medium
16138	phpGroupWare index.php Calendar Date XSS	medium
16093	MySQL Eventum index.php email Parameter XSS	medium
16058	YaCy Peer-To-Peer Search Engine XSS	medium
16012	ArGoSoft Mail Server Unspecified XSS	medium
16000	CVSTrac < 1.1.5 Multiple XSS	medium
15967	UseModWiki wiki.pl XSS	medium
15951	UBB.threads < 6.5.1 Multiple XSS	medium
15941	PunBB URL Quote Tag XSS	medium
15940	PunBB profile.php XSS	medium
15939	PunBB < 1.1.2 install.php XSS	medium
15937	PunBB IMG Tag Client Side Scripting XSS	medium
15914	Serendipity compat.php searchTerm Parameter XSS	medium
15908	Apache Jakarta Lucene results.jsp XSS	medium
15864	InMail/InShop inmail.pl / inshop.pl XSS	medium

Detections

Analytics

CGI abuses : XSS Family for Nessus

medium

medium

medium

medium

medium

medium

low

medium

medium

medium

medium

medium

medium

low

medium

medium

low

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

low

low

medium

medium

low

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium