Cofax 2.0 RC3 and earlier contains a cross-site scripting vulnerability in search.htm which allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter.
Remediation
Upgrade to a version of Cofax that is not affected by this vulnerability or apply the necessary patches provided by the vendor.
Details: CVE-2005-4385 matched at honey.scanme.sh
Protocol: HTTP
Full URL: https://honey.scanme.sh/search.htm?searchstring2&searchstring=%27%3E%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
Timestamp: Tue Apr 30 19:26:14 +0530 IST 2024
Template Information
Request
Response
References:
CURL command
Generated by Nuclei v3.2.5