Orion 1.3.8, 1.4.5, and CompaqHTTPServer 2.1 all fail to sanitize user supplied data when providing a 404 response with the information, allowing for cross site scripting attacks.
8f69936bc0c82c0a747bca8c2f6f1bb0a038cb6703d3c72f34754e227b045a74The following web servers do not properly sanitize their output when
returning a 404 resource not found error which could be used in a XSS
attack:
Orion 1.3.8
Orion 1.4.5
CompaqHTTPServer 2.1
PoC: http://localhost/<script>alert('XSS')</script>
--
- Josh
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed