logo Home

Untitled Document
Security Corporation Security Advisories


Untitled Document .: Sambar Server Cross-Site Scripting vulnerability :.
_______________________________________________________________

Security Corporation Security Advisory [SCSA-001]
________________________________________________________________________

PROGRAM: Sambar Server
HOMEPAGE: http://www.sambar.com/
VULNERABLE VERSIONS: 5.3 and prior
________________________________________________________________________


DESCRIPTION
________________________________________________________________________

"Sambar Server is the new standard in high performance multi-functional
servers with features rivaling other commercial products selling
separately for several hundreds of dollars. It's Winsock2 compliant Win32
integration functions on Windows 95, Windows 98, Windows NT, Win2000,
and XP as a service or as an application."
(direct quote from http://sambar.jalyn.net)


DETAILS
________________________________________________________________________


An exploitable bug was found on Sambar Server which cause javascript
execution on client's computer by following a crafted url.

This kind of attack known as "Cross-Site Scripting Vulnerability" is
present in search section of the web site, anyone can input specially
crafted links and/or other malicious scripts.


EXPLOITS
________________________________________________________________________


http://localhost/search/results.stm?query=<script>alert('Test%20of%20vulnerability');</script>


SOLUTIONS
________________________________________________________________________

No solution for the moment.


VENDOR STATUS
________________________________________________________________________

Sambar has been contacted.

------------------------------------------------------------------
Grégory Le Bras aka GaLiaRePt | http://www.Security-Corp.org
------------------------------------------------------------------



arrowSearch Advisories

arrowNewsletter

Free weekly Newsletter.

Please enter your email address here:
arrowReport Vulnerability

If you've found a vulnerability please
click here to report it.
arrowPartners

newsnow

About Us | Contact Us | Advertise | email | Backend flag
Copyright © 2016-2017 Security Corporation - All Rights Reserved - Legal - Privacy Policy