The remote host appears to be running a BasiliX version 1.1.0 or lower. Such versions are vulnerable to cross-scripting attacks since they do not filter HTML tags when showing a message.  As a result, an attacker can include arbitrary HTML and script code in a message and have that code executed by the user's browser when it is viewed.

The target is running at least one instance of SquirrelMail whose version number is between 1.2.0 and 1.2.10 inclusive.  Such versions do not properly sanitize From headers, leaving users vulnerable to XSS attacks.  Further, since SquirrelMail displays From headers when listing a folder, attacks does not require a user to actually open a message, only view the folder listing.

For example, a remote attacker could effectively launch a DoS against a user by sending a message with a From header such as :

From:John Doe<script>document.cookie='PHPSESSID=xxx; path=/';</script><>

which rewrites the session ID cookie and effectively logs the user out.

***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number(s) of Squirrelmail
***** installed there.

The remote host is running a version of PostNuke that contains the 'Reviews' module, which itself is vulnerable to a cross-site scripting issue.

An attacker may use this flaw to steal the cookies of the legitimate users of this website.

The remote host is running WebCamSoft's watchdog software.  There is a CGI script included in this software suite ('sresult.exe') that fails to sanitize user-supplied input to the 'cam' parameter before using it to generate dynamic output.  An attacker may exploit this issue to steal cookie-based credentials from a legitimate user of this site.

The remote version of Phorum contains a script called 'search.php' that is vulnerable to a cross-site scripting attack.  An attacker may be able to exploit this problem to steal the authentication credentials of third-party users.

The remote host is using PowerPortal, a content management system, written in PHP. 

A vulnerability exists in the remote version of this product that may allow a remote attacker to inject arbitrary HTML tags in when sending a private message to a victim user of the remote portal. 

An attacker may exploit this flaw to steal the credentials of another user on the remote host.

The remote server is running at least one instance of IMP whose version number is 3.2.4 or lower.  Such versions are vulnerable to a cross-scripting attack whereby an attacker may be able to inject arbitrary content, including script, in a specially crafted MIME message.  To have an effect, the victim must be using Internet Explorer to access IMP and be using the inline MIME viewer for HTML messages. 

Note : Nessus has determined the vulnerability exists on the target simply by looking at the version number of IMP installed there, it has not attempted to actually exploit the vulnerability.

The version of Moodle running on the remote host is affected by a cross-site scripting vulnerability. Input to the 'file' parameter of 'help.php' is not properly sanitized. A remote attacker can exploit this by tricking a user into requesting a maliciously crafted URL, resulting in stolen credentials.

The remote Xitami server is distributed with a script for testing server-side includes, '/testssi.ssi'.  This script is vulnerable to a cross-site scripting issue when sent a request with a malformed Host or User-Agent header.  An attacker may exploit this flaw the steal the authentication credentials of third-party users.

The remote host is running a version of phpBB older than 2.0.10.

phpBB contains a flaw that allows a remote cross-site scripting attack. This flaw exists because the application does not validate user-supplied input in the 'search_author' parameter.

This version is also vulnerable to an HTTP response splitting attack that permits the injection of CRLF characters in the HTTP headers.

The remote server is running a Citrix Web Interface server that is vulnerable to cross-site scripting.  When a user fails to authenticate, the Citrix Web Interface includes the error message text in the URL.  The error message can be tampered with to perform a cross-site scripting attack.

The remote server is running at least one instance of IMP whose version number is between 2.0 and 3.2.3 inclusive.  Such versions are vulnerable to a cross-scripting attack whereby an attacker may be able to cause a victim to unknowingly run arbitrary JavaScript code simply by reading a MIME message with a specially crafted Content-Type header. 

Note : Nessus has determined the vulnerability exists on the target simply by looking at the version number of IMP installed there; it has not attempted to actually exploit the vulnerability.

The target is running at least one instance of Open WebMail whose version is 2.32 or earlier.  Such versions are vulnerable to a cross- site scripting attack whereby an attacker can cause a victim to unknowingly run arbitrary JavaScript code by reading a MIME message with a specially crafted Content-Type or Content-Description header. For further information, see :

  http://www.openwebmail.org/openwebmail/download/cert/advisories/SA-04:05.txt   http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-2.txt   http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt

***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number of Open WebMail
***** installed there.

The remote host is running a version of the Oracle9i 'isqlplus' CGI that is vulnerable to a cross-site scripting attack. 

An attacker may exploit this flaw to steal the cookies of legitimate users on the remote host.

There is a bug in the version of Invision Power Board on the remote host that makes it vulnerable to cross-site scripting attacks.  An attacker may exploit this issue to steal the credentials of legitimate users of this site.

The remote host is running a version of vHost that is older than 3.10r1. There is a cross-site scripting vulnerability in this version that may allow an attacker to steal the cookies of the legitimate users of this site.

There are cross-site scripting vulnerabilities in the files 'ViewTopic.php' and 'ViewForum.php' in the remote installation of phpBB.

The remote host is running SandSurfer, a web-based time keeping application. 

A vulnerability has been disclosed in all versions of this software, up to version 1.7.0 (included) which may allow an attacker to use it to perform cross-site scripting attacks against third-party users.

There is a cross-site scripting issue in vBulletin that may allow an attacker to steal a user's cookies.

The remote host is running the ASP Portal CGI suite.

There is a cross-site scripting issue in this suite that may allow an attacker to steal your users cookies.

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on the remote host.

The remote host is using the miniBB forum management system.
According to its version number, this forum is vulnerable to a cross-site scripting bug.  A remote attacker could exploit this to impersonate a legitimate user by tricking them into requesting a maliciously crafted URL.

The remote host is running the CGI 'sgdynamo.exe'. 

There is a bug in some versions of this CGI which makes it vulnerable to a cross-site scripting attack.

The remote server is running at least one instance of IMP whose version number is between 3.0 and 3.2.1 inclusive.  Such versions are vulnerable to several cross-scripting attacks whereby an attacker can cause a victim to unknowingly run arbitrary JavaScript code simply by reading an HTML message from the attacker. 

Note : Nessus has determined the vulnerability exists on the target simply by looking at the version number of IMP installed there.  If the installation has already been patched, consider this a false positive.

The version of Gallery hosted on the remote web server is affected by a cross-site scripting attack due to a failure to properly sanitize user-supplied input to the 'searchstring' parameter of the 'search.php' script.  A remote attacker may use this to steal the cookies from the legitimate users of this system.

The remote host is running Tmax Soft JEUS, a web application written in Java.

Input to the query string is not properly sanitized, which could lead to a cross-site scripting attack.  A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL.  This would allow the attacker to impersonate the targeted user.

The remote host is hosting the Pod.Board CGI suite, a set of PHP scripts designed to manage online forums.

There is a cross-site scripting issue in this suite that could allow an attacker to steal the cookies of your legitimate users, by luring them into clicking on a rogue URL.

The remote host is running a version of PostNuke that is vulnerable to various cross-site scripting attacks.

An attacker may use these flaws to steal the cookies of the legitimate users of this website.

The remote web server is running LedNews, a set of scripts designed to help maintain a news-based website.

There is a flaw in some versions of LedNews that could allow an attacker to include rogue HTML code in the news, which may in turn be used to steal the cookies of people visiting this site, or to annoy them by showing pop-up error messages and such.

The remote host is running the Zeus WebServer.

There is a vulnerability in the CGI 'vs_diag.cgi' that may allow an attacker to gain administrative access on that server.  To exploit this flaw, the attacker would need to lure the administrator of this server to click on a rogue link.

The remote host is running the Bandmin CGI suite. 

There is a cross-site scripting issue in this suite that may allow an attacker to steal your users cookies. 

The flaw lies in the cgi bandwitdh/index.cgi

The remote host is using ezPublish, a content management system.

There is a flaw in the remote ezPublish which lets an attacker perform a cross-site scripting attack. An attacker may use this flaw to steal the cookies of your legitimate users.

The remote host is running the Neoteris IVE.

There is a cross-site scripting issue in this server (in the CGI swsrv.cgi) that could allow an attacker to perform a session hijacking.

According to its banner, the version of SHOUTcast Server installed on the remote host is earlier than 1.9.5.  Such versions do not properly validate user input before storing it in its log file.  An attacker may use this flaw to perform a cross-site scripting attack against the administrators of the remote service and steal the administrators' cookies.

According to the web server banner, the version of mod_ssl running on the remote host has a cross-site scripting vulnerability. A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL, resulting in stolen credentials.

Note that several Linux distributions (such as RedHat) patched the old version of this module.  Therefore, this might be a false positive. Please check with your vendor to determine if you really are affected by this flaw.

The remote host has a CGI called 'testcgi.exe' installed under /cgi-bin that is vulnerable to a cross-site scripting issue.

The remote server is running Ocean12 GuestBook, a set of scripts to manage an interactive guestbook.

An attacker may use this module to inject malicious HTML code in your site, which may be used to steal users' cookies or to simply annoy them.

The remote host is running XMB Forum, a web forum written in PHP.

The version of XMB installed on the remote host is affected by several cross-site scripting issues.

There is a cross-site scripting issue in the version of XOOPS installed on the remote host that may allow an attacker to steal your user cookies.  The flaw lies in 'glossaire-aff.php'.

The remote host is running cc_guestbook.pl, a guestbook written in Perl. 

This CGI is vulnerable to a cross-site scripting attack.  An attacker may use this flaw to steal the cookies of your users.

The Sambar web server comes with a set of CGIs are that vulnerable to a cross-site scripting attack.

An attacker may use this flaw to steal the cookies of your web users.

The version of paFileDB installed on the remote host is vulnerable to cross-site scripting attacks due to its failure to sanitize input to the 'id' parameter of the 'pafiledb.php' script before using it to generate dynamic HTML.  An attacker may use these flaws to steal cookies of users of the affected application.

The remote host is vulnerable to a cross-site scripting attack through its web chat module :

- An attacker may create a new user with a bogus email address containing   JavaScript code
- Then the profile of the newly created user or the 'lost password' page   for this user will display the unprocessed JavaScript to the user

An attacker may use this flaw to steal the cookies of your regular users.

ezPublish 2.2.7 has a cross-site scripting bug. An attacker may use it to perform a cross-site scripting attack on this host.

In addition to this, another flaw may allow an attacker store hostile HTML code on the server side, which will be executed by the browser of the administrative user when he looks at the server logs.

Siteframe 2.2.4 has a cross-site scripting bug. An attacker may use it to perform a cross-site scripting attack on this host.

In addition to this, another flaw in this package may allow an attacker to obtain the physical path to the remote web root.

The version of DCP-Portal installed on the remote host fails to sanitize input to the script 'calendar.php' before using it to generate dynamic HTML, that could let an attacker execute arbitrary code in the browser of a legitimate user.

It may also be affected by HTML injection flaws, which could let an attacker to inject hostile HTML and script code that could permit cookie-based credentials to be stolen and other attacks, and HTTP response splitting flaw, that could let an attacker to influence or misrepresent how web content is served, cached or interpreted.

DCP-Portal has been reported to be vulnerable to an HTTP response splitting attack via the PHPSESSID parameter when passed to the calendar.php script. However, Nessus has not checked for this issue.

Basit cms 1.0 has a cross-site scripting bug. An attacker may use it to perform a cross-site scripting attack on this host.

In addition to this, it is vulnerable to a SQL insertion attack that could allow an attacker to get the control of your database.

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on this host.

osCommerce is a widely installed open source shopping e-commerce solution.
An attacker may use it to perform a cross-site scripting attack on this host.

The remote host seems to be running MyAbraCadaWeb. An attacker may use it to perform a cross-site scripting attack on this host, or to reveal the full path to its physical location by sending a malformed request.

ID	Name	Severity
14218	BasiliX Message Content XSS	medium
14217	SquirrelMail < 1.2.11 Multiple Script XSS	medium
14189	PostNuke Reviews Module title Parameter XSS	medium
14186	WebCam Watchdog sresult.exe XSS	medium
14185	Phorum search.php subject Parameter XSS	medium
14178	PowerPortal modules/private_messages/index.php Multiple Parameter XSS	medium
13857	Horde IMP with MSIE MIME Viewer Email Message XSS	medium
13843	Moodle < 1.3.3 'help.php' 'file' Parameter XSS	medium
13841	Xitami testssi.ssi HTTP Header XSS	medium
13840	phpBB < 2.0.10 Multiple XSS	medium
12301	Citrix MetaFrame XP login.asp NFuse_Message Parameter XSS	medium
12263	IMP Content-Type Header XSS	medium
12262	Open WebMail Multiple Content Header XSS	medium
12112	Oracle 9iAS iSQLplus XSS	medium
12101	Invision Power Board index.php pop Parameter XSS	medium
12094	vHost < 3.10r1 Unspecified XSS	medium
12093	phpBB < 2.0.7 Multiple XSS	medium
12087	SandSurfer < 1.7.1 XSS	medium
12058	vBulletin search.php query Parameter XSS	medium
12057	ASP Portal User Profile XSS	medium
12045	Mambo Site Server itemid Parameter XSS	medium
11972	miniBB bb_func_usernfo.php Website Name Field XSS	medium
11955	SGDynamo sgdynamo.exe HTNAME XSS	medium
11815	Horde IMP IMP_MIME_Viewer_html Class XSS	medium
11810	Gallery search.php searchstring Parameter XSS	medium
11764	TMaxSoft JEUS url.jsp URI XSS	medium
11760	pod.board 1.1 Multiple Script XSS	medium
11743	PostNuke < 0.7.2.3 Multiple Script XSS	medium
11741	LedNews News Post XSS	medium
11681	Zeus Admin vs_diag.cgi XSS	medium
11672	Bandmin 1.4 index.cgi Multiple Parameter XSS	medium
11644	eZ Publish articleview.php XSS	medium
11608	Neoteris IVE swsrv.cgi XSS	medium
11624	SHOUTcast Server Admin Log File XSS	medium
11622	Apache mod_ssl Host: Header XSS	medium
11610	Ceilidh testcgi.exe query Parameter XSS	medium
11537	Ocean12 Guestbook XSS	medium
11527	XMB < 1.9.1 Multiple XSS	medium
11508	XOOPS Glossary Module glossaire-aff.php lettre Parameter XSS	medium
11503	CC GuestBook cc_guestbook.pl Multiple Parameter XSS	medium
11492	Sambar Server Multiple Script XSS	medium
11479	paFileDB pafiledb.php id Parameter XSS	medium
11470	WebChat XSS	medium
11449	ez Publish Multiple XSS	medium
11448	Siteframe search.php searchfor Parameter XSS	medium
11446	DCP-Portal Multiple Script XSS	medium
11445	Basit CMS Multiple Script XSS	medium
11441	Mambo Site Server 4.0.10 XSS	medium
11437	osCommerce 2.2ms1 Multiple Script XSS	medium
11417	MyAbraCadaWeb header.php ma_kw Parameter XSS	medium

Detections

Analytics

CGI abuses : XSS Family for Nessus

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium