The host is running Santafox and is prone to Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities.

Successful exploitation will allow attackers to execute arbitrary web script or HTML in a user's browser session in the context of an affected site. Impact Level: Application

Upgrade to SantaFox version 3.01, for updates refer to http://www.santafox.ru/download.html

The flaws are caused by, - improper validation of user-supplied input passed via the 'search' parameter to search.html, that allows attackers to execute arbitrary HTML and script code on the web server. - Cross-site request forgery vulnerability in admin/manager_users.class.php, allows remote attackers to hijack the authentication of administrators.

SantaFox 2.02 and prior.

• http://packetstormsecurity.org/1009-exploits/santafox-xssxsrf.txt
• http://secunia.com/advisories/41465
• http://www.securityfocus.com/archive/1/archive/1/513737/100/0/threaded
• http://www.securityfocus.com/archive/1/archive/1/513738/100/0/threaded

---

Updated on 2015-03-25