WampServer 2.0i (index.php) Remote Cross Site Scripting Vulnerability
Title: WampServer 2.0i (index.php) Remote Cross Site Scripting Vulnerability
Advisory ID: ZSL-2010-4926
Type: Remote
Impact: Cross-Site Scripting
Risk: (2/5)
Release Date: 22.02.2010
[2] http://securityreason.com/exploitalert/7841
[3] http://www.securityfocus.com/bid/38357
[4] http://www.packetstormsecurity.org/filedesc/wamp-xss.txt.html
[5] http://osvdb.org/62481
[6] http://www.security-database.com/detail.php?alert=CVE-2010-0700
[7] http://olex.openlogic.com/wazi/2010/wampserver-2-0i-medium/
[8] http://en.securitylab.ru/nvd/391082.php
[9] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0700
[10] http://securityreason.com/securityalert/7052
[11] http://xforce.iss.net/xforce/xfdb/56417
[12] http://www.net-security.org/vuln.php?id=11244
[13] http://www.us-cert.gov/cas/bulletins/SB10-060.html
[14] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0700
[22.02.2010] - Added reference [1] and [2]
[23.02.2010] - Added reference [3], [4] and [5]
[26.02.2010] - Added reference [6], [7], [8] and [9]
[28.02.2010] - Added reference [10]
[03.03.2010] - Added reference [11], [12] and [13]
[25.10.2021] - Added reference [14]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2010-4926
Type: Remote
Impact: Cross-Site Scripting
Risk: (2/5)
Release Date: 22.02.2010
Summary
WampServer - Apache, PHP, MySQL on Windows.Description
WampServer is susceptible to cross-site scripting vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input. An attacker may leverage any of the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials, phishing as well as other attacks.Vendor
Romain Bourdon (Roms) - http://www.wampserver.comAffected Version
2.0iTested On
Microsoft Windows XP Professional SP3 (English)Vendor Status
N/APoC
wamp_xss.txtCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] http://secunia.com/advisories/38706[2] http://securityreason.com/exploitalert/7841
[3] http://www.securityfocus.com/bid/38357
[4] http://www.packetstormsecurity.org/filedesc/wamp-xss.txt.html
[5] http://osvdb.org/62481
[6] http://www.security-database.com/detail.php?alert=CVE-2010-0700
[7] http://olex.openlogic.com/wazi/2010/wampserver-2-0i-medium/
[8] http://en.securitylab.ru/nvd/391082.php
[9] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0700
[10] http://securityreason.com/securityalert/7052
[11] http://xforce.iss.net/xforce/xfdb/56417
[12] http://www.net-security.org/vuln.php?id=11244
[13] http://www.us-cert.gov/cas/bulletins/SB10-060.html
[14] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0700
Changelog
[22.02.2010] - Initial release[22.02.2010] - Added reference [1] and [2]
[23.02.2010] - Added reference [3], [4] and [5]
[26.02.2010] - Added reference [6], [7], [8] and [9]
[28.02.2010] - Added reference [10]
[03.03.2010] - Added reference [11], [12] and [13]
[25.10.2021] - Added reference [14]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
