[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Cobalt RaQ Control Panel Cross Site Scripting
- To: "Lorenzo Hernandez Garcia-Hierro" <lorenzohgh@nsrg-security.com>, "Bugtraq" <bugtraq@securityfocus.com>
- Subject: RE: Cobalt RaQ Control Panel Cross Site Scripting
- From: "Steve Manzuik" <steve@entrenchtech.com>
- Date: Sat, 4 Oct 2003 19:04:18 -0600
> it is a security hole because it demonstrates that the message.cgi script
> does not have
> an input validation system.
This isn't a security hole but more of a scripting mistake. You don't gain any
additional access, you don't r00t the box, you don't even steal another users
session. Common best practices would tell anyone worth their wage to enable
SSL and not allow access to TCP 444 (the control panel interface default port)
to the outside anyways.
I fail to see how there is anything exploitable here.
-S