The host is installed with Kiwix and is prone to xss vulnerability.

Successful exploitation will allow remote attackers to execute arbitrary HTML and script code in a users browser session in the context of an affected site. Impact Level: Application

Apply the patch manually from the given link, http://sourceforge.net/p/kiwix/kiwix/ci/d1af5f0375c6db24d4071acf4806735725fd206e

Input passed via the 'pattern' parameter to '/search' is not properly sanitised before being returned to the user.

Kiwix version 0.9 and prior.

Send a crafted data via HTTP GET request and check whether it is able to read cookie or not.

• http://osvdb.org/117199
• http://packetstormsecurity.com/files/130007
• http://sourceforge.net/p/kiwix/bugs/763
• http://sourceforge.net/p/kiwix/kiwix/ci/d1af5f0375c6db24d4071acf4806735725fd206e
• http://www.securityfocus.com/archive/1/archive/1/534502/100/0/threaded

---

Updated on 2015-03-25