Summit Computer Networks Lil' HTTP Server 2 - 'URLCount.cgi' HTML Injection

EDB-ID:

21581

CVE:

2002-1008

EDB Verified:

Author:

Matthew Murphy

Type:

remote

Exploit: /

Platform:

Windows

Date:

2002-06-27

Vulnerable App:

Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.

GET CERTIFIED

source: https://www.securityfocus.com/bid/5115/info

Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks.

Reportedly, Lil' HTTP Server is vulnerable to HTML injection attacks.

The vulnerability is present in the 'REPORT' function found in the 'urlcount.cgi' script. While the CGI does filter script tags, other HTML elements are not sufficiently sanitized, allowing for arbitrary HTML to be injected into the reports page.

http://target/urlcount.cgi?%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28%27xss%27%29%22%3E

This will affect web users who visit the reports page:

http://target/urlcount.cgi?REPORT

Tags:

Advisory/Source: Link

Downloads	Certifications	Training	Professional Services
Kali Linux	OSCP	Penetration Testing with Kali Linux (PWK) - ALL NEW for 2020	Penetration Testing
Kali NetHunter	OSWP	Advanced Web Attacks and Exploitation (AWAE)	Advanced Attack Simulation
Kali Linux Revealed Book	OSCE	Offensive Security Wireless Attacks (WiFu)	Application Security Assessment
	OSEE	Cracking the Perimeter (CTP)
	OSWE	Metasploit Unleashed (MSFU)
	KLCP	Free Kali Linux Training