APC Network Management Card - Cross-Site Request Forgery / Cross-Site Scripting
Author: Jamal Pecou
type: remote
platform: multiple
port:
date_added: 2009-12-15
date_updated: 2014-05-18
verified: 1
codes: CVE-2009-1798;OSVDB-61288
tags:
aliases:
screenshot_url:
application_url:
source: https://www.securityfocus.com/bid/37338/info
The APC Network Management Card is prone to multiple cross-site request-forgery and cross-site scripting vulnerabilities.
An attacker can exploit the cross-site request forgery issues to alter the settings on affected devices, which may lead to further network-based attacks.
The attacker can exploit the cross-site scripting issues to execute arbitrary script code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible.
Versions prior to the following are vulnerable:
Network Management Card Firmware 3.7.2
Network Management Card Firmware 5.1.1
http://www.example.com/Forms/login1?login_username=<ScRiPt>alert('hello');</ScRiPt>