APC Switched Rack PDU XSS Vulnerability

[jpecou () gmail com]

###########################################

#APC Switched Rack PDU XSS Vulnerability#
#By Jamal Pecou #
#jpecou (at) gmail (dot) c0m. #

###############Product Info#################

                #Product Info(Tested Versions)#
Model = AP7932
Harware Revision = B2

                #Application Module#
Name = rpdu
Version = v3.3.3(Tested First) 
Version = 3.7.0(Current)

                #APC OS (AOS)
Name = aos
Version = v3.3.4

###############Vulnerability################

XSS Vulnerability:

The APC Switch RACK PDU web administration login page is prone to a cross-site scripting vulnerability because the 
application fails to sufficiently sanitize user-supplied input. 

The script "login1" located in the Forms directory fails to properly sanitize user input data in the login_username 
field

####################PoC#####################

Proof-of-Concept

http://<PDU IP>/Forms/login1?login_username=<ScRiPt>alert('hello');</ScRiPt>


################Additional#################

Jun 17th 2009 - Vulnerability Discovered

Jun 18th 2009 - Contacted Vendor

Jun 21st 2009 - APC Creates a ticket and enters finding into bug tracking database.

Dec 14th 2009 - APC, no patches released.

###########################################