-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 FYI, from bugtraq
- ---------- Forwarded Message ---------- Subject: RE: Cobalt RaQ Control Panel Cross Site Scripting Date: Saturday 04 October 2003 18:04 From: "Steve Manzuik" <[EMAIL PROTECTED]> To: "Lorenzo Hernandez Garcia-Hierro" <[EMAIL PROTECTED]>, "Bugtraq" <[EMAIL PROTECTED]> > it is a security hole because it demonstrates that the message.cgi script > does not have an input validation system. This isn't a security hole but more of a scripting mistake. You don't gain any additional access, you don't r00t the box, you don't even steal another users session. Common best practices would tell anyone worth their wage to enable SSL and not allow access to TCP 444 (the control panel interface default port) to the outside anyways. I fail to see how there is anything exploitable here. - -S - ------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE/gazSvLA2hUZ9kgwRAhuVAKCAMieB1VLG+o8yyXiozbdB2e+TpQCcDcuh 8381LW1xhUvm5xieRsFRy2s= =UgeE -----END PGP SIGNATURE----- _______________________________________________ cobalt-security mailing list [EMAIL PROTECTED] http://list.cobalt.com/mailman/listinfo/cobalt-security
