Full Disclosure mailing list archives
Wing FTP Server - Cross Site Scripting Vulnerability
From: werew01f <hack.werew01f () gmail com>
Date: Wed, 2 Jun 2010 17:35:33 +0800
Security Advisory: Wing FTP Server - Cross Site Scripting Vulnerability ======================================================== Discovered Date: May 31, 2010 System affected: Wing FTP Server for Windows, Version 3.5.0 and prior version Vulnerability Description: ================== Wing FTP server is a multi-protocol file server, which support such as HTTP and FTP. It comes with a Web-based "Administrator" Console. The XSS vulnerability is found in the "Administrator" Web interface. In the "Administrator" web interface, script can be injected from the POST command. This can be exploited by injecting arbitrary HTML and malicious script code, which will execute in a user's browser session. The Vulnerable URL: http://x.x.x.x:5466/admin_loginok.html (Default port is 5466). Researcher Info: ============ Discovered by: w01f Website: http://labs-werew01f.blogspot.com E-mail: hack [dot] werew01f [at] gmail [dot] com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Wing FTP Server - Cross Site Scripting Vulnerability werew01f (Jun 02)
- Re: Wing FTP Server - Cross Site Scripting Vulnerability werew01f (Jun 07)