CVE-2004-2564
published 2004-12-31CVE-2004-2564: Multiple cross-site scripting (XSS) vulnerabilities in Sambar Server 6.1 Beta 2 on Windows, and possibly other versions on Linux, allow remote attackers to…
PriorityP421medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
4.73%
90.7th percentile
Multiple cross-site scripting (XSS) vulnerabilities in Sambar Server 6.1 Beta 2 on Windows, and possibly other versions on Linux, allow remote attackers to inject arbitrary web script or HTML via (1) the show parameter in show.asp and (2) the title parameter in showperf.asp.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sambar | sambar_server | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Sambar Server 6.1 Beta 2 - 'showperf.asp?title' Cross-Site Scripting
exploitdb·2004-06-01
CVE-2004-2564 Sambar Server 6.1 Beta 2 - 'showperf.asp?title' Cross-Site Scripting
Sambar Server 6.1 Beta 2 - 'showperf.asp?title' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/10444/info
Sambar Server is reportedly prone to multiple vulnerabilities. These issues may allow an attacker to access sensitive files and carry out directory traversal and cross-site scripting attacks.
These issues require an attacker to have administrative privileges, however, it is reported that an administrative password is not set on the server by default. An administrator who is not intended to have certain privileges may also exploit these vulnerabilities.
Sambar 6.1 Beta 2 is reported to be prone to these issues, however, it is likely that other versions are affected as well.
http://www.example.com/sysadmin/system/showperf.asp?area=search&title=alert(document.coo
Exploit-DB
Sambar Server 6.1 Beta 2 - 'show.asp?show' Cross-Site Scripting
exploitdb·2004-06-01
CVE-2004-2564 Sambar Server 6.1 Beta 2 - 'show.asp?show' Cross-Site Scripting
Sambar Server 6.1 Beta 2 - 'show.asp?show' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/10444/info
Sambar Server is reportedly prone to multiple vulnerabilities. These issues may allow an attacker to access sensitive files and carry out directory traversal and cross-site scripting attacks.
These issues require an attacker to have administrative privileges, however, it is reported that an administrative password is not set on the server by default. An administrator who is not intended to have certain privileges may also exploit these vulnerabilities.
Sambar 6.1 Beta 2 is reported to be prone to these issues, however, it is likely that other versions are affected as well.
http://www.example.com/sysadmin/system/show.asp?show=alert("oops")
No writeups or analysis indexed.
http://secunia.com/advisories/11748http://securitytracker.com/id?1010353http://www.oliverkarow.de/research/sambar.txthttp://www.osvdb.org/6583http://www.osvdb.org/6584http://www.securityfocus.com/bid/10444https://exchange.xforce.ibmcloud.com/vulnerabilities/16286http://secunia.com/advisories/11748http://securitytracker.com/id?1010353http://www.oliverkarow.de/research/sambar.txthttp://www.osvdb.org/6583http://www.osvdb.org/6584http://www.securityfocus.com/bid/10444https://exchange.xforce.ibmcloud.com/vulnerabilities/16286
2004-12-31
Published