Nagios XI Login XSS
Advisory ID: NGENUITY-2010-007
Class: Cross-Site Scripting (XSS)
Nagios XI is the commercial / enterprise version of the open source
The login page for the Nagios XI management interface prior to version
2009R1.3 is vulnerable to cross-site scripting (XSS). This vulnerability
does not require the victim to be authenticated. This vulnerability was
originally thought to be addressed in version 2009R1.2C.
All the parameters of the login page are vulnerable to injection and
the user is authenticated can provide a reasonably easy way to do
whatever actions you want as the Admin user (and negates CSRF protection
that has recently been implemented).
Vendor recommends upgrading to version 2009R1.3 or later.
Here is a non-malicious example. The input after login.php is inserted
into the permalink_base variable without being sanitized.
This vulnerability was discovered by Adam Baldwin