Critical Unrestricted File Upload vulnerability found @ Web-Based Teaching System (Myanmar) URL : http://www.wbts.com.mm
Malicious Attacker can upload some file to server without permission ! And It has persistent XSS vulnerability.
Cross Site Scripting is a client-side attack where an attacker can craft a malicious link, containing script- code which is then executed within the victim’s browser when the target site vulnerable to and injected with XSS is viewed. The script-code can be any language supported by the browser but mostly HTML and Javascript is used along with embedded Flash, Java or ActiveX.
The persistent XSS can be triggered just by browsing a Web Application with code injected into it. (This depends on which page has code injected, in case the target is not globally affected on all pages loaded by the user.)
Details
=======
Used Product : ColdFusion 9
Vulnerability Type : Unrestricted File Upload & Persistent XSS
Security Risk : Critical
Effected URL : http://www.wbts.com.mm/dcs/act_reg.cfm
CVE : CVE-2005-0254
CVE URL : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE2005-0254
Informed to :- Webmaster
This is vulnerability is posted at Vulnerabilities Research Page : http://www.planetcreator.net/category/hacking/
We hope that your security staff will look into this issue and fix it as soon as possible.