dotDefender Firewall 5.00.12865 / 5.13-13282 Cross Site Scripting

                							

                [+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/DOT-DEFENDER-VULN-FLASH.txt



Vendor:
==================
www.applicure.com



Product:
=====================
dotDefender Firewall
Versions: 5.00.12865 / 5.13-13282


dotDefender is a Web application firewall (WAF) for preventing hacking
attacks like XSS, SQL Injections, CSRF etc...
that provides Apache and IIS Server Security across Dedicated, VPS and
Cloud environments. It meets PCI Compliance and also
provides E-Commerce Security, IIS and Apache Security, Cloud Security and
more.



Vulnerability Type:
===================
XSS


Vulnerability Details:
=====================
Dotdefender firewall is vulnerable to cross site scripting attacks as it
comes compiled with a vulnerable third party
Flash based chart application "Open Flash Chart" (CVE-2013-1636) which
suffers from a well known XSS vulnerability.

Reference:
http://www.securityfocus.com/bid/59928/exploit



Exploitation Technique:
=======================
Remote



Severity Level:
================
High



Description:
========================================================

Request Method(s):        [+] GET


Vulnerable Product:       [+] DotDefender v5.0 & v5.13


=========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
<p>