UPC Cablecom www.cablecom.ch sendertabelle.htm cross site scripting ⚔ [Disputed]

Summaryinfo

A vulnerability classified as problematic was found in UPC Cablecom. This affects an unknown function of the file sendertabelle.htm of the component www.cablecom.ch. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. Furthermore, an exploit is available. It is still unclear if this vulnerability genuinely exists. Disabling the affected component is advisable.

Detailsinfo

A vulnerability was found in UPC Cablecom (version unknown) and classified as critical. Affected by this issue is an unknown function of the file sendertabelle.htm of the component www.cablecom.ch. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. Impacted is confidentiality, integrity, and availability.

The weakness was published 07/08/2003 by Marc Ruef with scip AG (Website). The advisory is shared for download at computec.ch. The public release happened without coordination with the vendor. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1059.007.

A public exploit has been developed by Marc Ruef in URL/HTML and been published immediately after the advisory. The exploit is available at cablecom.ch. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. By approaching the search of inurl:sendertabelle.htm it is possible to find vulnerable targets with Google Hacking. The vulnerability scanner Nessus provides a plugin with the ID 11492 (Sambar Server Multiple Script XSS), which helps to determine the existence of the flaw in a target environment. It is assigned to the family CGI abuses : XSS.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at cablecom.ch. Attack attempts may be identified with Snort ID 1497.

The vulnerability is also documented in the vulnerability database at Tenable (11492). cgisecurity.com is providing further details. Similar entries are available at VDB-83, VDB-93, VDB-104 and VDB-107. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• UPC

Name

• Cablecom

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion