This host is installed with Quixplorer and is prone to multiple vulnerabilities.

Successful exploitation will allow remote attackers to gain access to arbitrary files and execute arbitrary script code in a user's browser within the trust relationship between user's browser and the server. Impact Level: System/Application

Upgrade to Quixplorer version 2.5.5 or later. For updates refer to https://github.com/realtimeprojects/quixplorer

Multiple errors exist as the input passed via the 'dir', 'item', 'order', 'searchitem', 'selitems[]', and 'srt' parameters is not validated upon submission to the /quixplorer/src/index.php script.

Quixplorer version 2.5.4 and prior.

Send a crafted data via HTTP GET request and check whether it is able to read cookie or not.

• http://secunia.com/advisories/55725
• http://www.osvdb.org/100343
• http://www.osvdb.org/100344
• https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-030.txt

---

Updated on 2015-03-25