Summary
This host is installed with Rockmongo and is prone to cross site scripting and directory traversal vulnerabilities.
Impact
Successful exploitation will allow remote attackers to gain access to arbitrary sensitive files and execute arbitrary script code in a user's browser within the trust relationship between the browser and the server.
Impact Level: System/Application
Solution
No Solution or patch is available as of 24th December, 2013. Information regarding this issue will be updated once the solution details are available.
For updates refer to http://rockmongo.com
Insight
The flaws are due to
- An improper validation of user-supplied input in 'xn' function via 'db' and 'username' parameters to 'index.php' script.
- An improper validation of user-supplied input via other unspecified parameters.
- An improper sanitizing user input via 'ROCK_LANG' cookie to 'index.php' script.
Affected
Rockmongo versions 1.1.5 and prior.
Detection
Send a crafted data via HTTP GET request and check whether it is vulnerable or not.
References
Severity
Classification
-
CVE CVE-2013-5107, CVE-2013-5108 -
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
Related Vulnerabilities