CVE-2007-0302: XSS
Multiple cross-site scripting (XSS) vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to (a) Logon.aspx, and the (2) Username and (3) Update parameters to (b) Members1.aspx.
Affected Software
Event History
Frequently Asked Questions
Which application endpoints and inputs should be prioritized for testing and monitoring?
Review Logon.aspx for the SessionID parameter and Members1.aspx for the Username and Update parameters. These are the inputs identified as accepting injected web script or HTML.
Can this be exploited remotely without authentication?
Yes. The provided CVSS vector lists network access and no authentication requirement, indicating an unauthenticated remote attacker can attempt exploitation.
What is the likely impact if exploitation succeeds?
The vulnerability allows injection of arbitrary web script or HTML. The supplied CVSS vector indicates potential impacts to confidentiality, integrity, and availability.