Summary
This host is installed with POSH and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow remote attackers to steal the victim's cookie-based authentication credentials, execute SQL commands and obtain sensitive information.
Impact Level: Application.
Solution
Upgrade to version POSH version 3.3.0 or later.
For updates refer to http://sourceforge.net/projects/posh
Insight
Multiple flaws are due to,
- An input passed via the 'rssurl' parameter to 'addtoapplication.php' and 'error' parameter to 'login.php', which is not properly sanitised before using it.
- It stores the username and md5 digest of the password in the cookie.
- Improper validation of the 'redirect' parameter upon submission to the /posh/portal/scr_sendmd5.php script.
Affected
POSH version before 3.3.0
Detection
Send a crafted exploit string via HTTP GET request and check whether it is able to read the cookie or not.
References
Severity
Classification
-
CVE CVE-2014-2211, CVE-2014-2212, CVE-2014-2213, CVE-2014-2214 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities