CVE-2004-2550

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in unspecified Perl scripts in SandSurfer versions before 1.7.1 [1]. The flaws allow remote attackers to inject arbitrary web script or HTML into data that is later rendered in reports [1].

Exploitation

An attacker can inject malicious script or HTML via the vulnerable Perl scripts without requiring authentication, as the input is not sanitized [1]. The injected payload is stored and executed when a target user views the reports containing the injected data [1].

Impact

Successful exploitation leads to arbitrary script execution in the context of the victim's browser when viewing reports [1]. This can result in information disclosure, session hijacking, or other client-side attacks [1].

Mitigation

Upgrade to SandSurfer version 1.7.1 or later, which addresses the vulnerabilities [1]. No workarounds are disclosed in the available references [1].