Nessus Plugin #15462

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

CjOverkill trade.php XSS

Family:

CGI abuses : XSS

Category:

infos

Copyright:

This script is Copyright (C) 2004 David Maciejak

Summary:

Check CjOverkill version

Version:

$Revision: 1.4 $

Cve_id:

-

Bugtraq_id:

11359

Xrefs:

-

Description:

The remote server runs a version of CjOverkill, a free traffic trading
script which is as old as or older than version 4.0.3.

The remote version of this software is affected by a cross-site scripting
vulnerability in the script 'trade.php'. This issue is due to a failure
of the application to properly sanitize user-supplied input.

As a result of this vulnerability, it is possible for a remote attacker
to create a malicious link containing script code that will be executed
in the browser of an unsuspecting user when followed.

This may facilitate the theft of cookie-based authentication credentials
as well as other attacks.

Solution : Upgrade to version 4.0.4 or newer.
Risk factor : Medium