AOH :: HP Unsorted C :: BU-1326.HTM

ClarkConnect XSS vulnerability



ClarkConnect XSS vulnerability
ClarkConnect XSS vulnerability



Hello,

I have found an XSS vulnerability in ClarkConnect web interface.
ClarkConnect is an internet server and gateway that provides protocol filtering, bandwidth management, Windows File Sharing / Samba, LDAP Directory Integration and other features...
The vulnerability was found in the latest version of this product (5.0).
ClarkConnect installs a Web server on port 82 to process the PHP scripts it uses for configuration.

Proof of concept:
http://server_address:82/public/proxy.php?url= 

Obviously, the 'url' GET variable is not well sanitized.

Best regards,
Edgard Chammas [454447415244]

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.