medium4.3Public exploit code
CVE-2011-4273
Multiple cross-site scripting (XSS) vulnerabilities in GoAhead Webserver 2.18 allow remote attackers to inject arbitrary web script or HTML via (1) the group p…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GoAhead Web Server 2.18 - 'adduser.asp' Multiple Cross-Site Scripting Vulnerabilities2011-10-10 · remote · windows · Verified
- GoAhead Web Server 2.18 - 'addlimit.asp?url' Cross-Site Scripting2011-10-10 · remote · windows · Verified
- GoAhead Web Server 2.18 - 'addgroup.asp?group' Cross-Site Scripting2011-10-10 · remote · windows · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in GoAhead Webserver 2.18 allow remote attackers to inject arbitrary web script or HTML via (1) the group parameter to goform/AddGroup, related to addgroup.asp; (2) the url parameter to goform/AddAccessLimit, related to addlimit.asp; or the (3) user (aka User ID) or (4) group parameter to goform/AddUser, related to adduser.asp.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Goahead | Goahead Webserver | Version 2.1.8 |