APC Switched Rack PDU XSS Vulnerability

###########################################

#APC Switched Rack PDU XSS Vulnerability#
#By Jamal Pecou #
#jpecou (at) gmail (dot) c0m. #

###############Product Info#################

            #Product Info(Tested Versions)#

Model = AP7932
Harware Revision = B2

            #Application Module#

Name = rpdu
Version = v3.3.3(Tested First)
Version = 3.7.0(Current)

            #APC OS (AOS)

Name = aos
Version = v3.3.4

###############Vulnerability################

XSS Vulnerability:

The APC Switch RACK PDU web administration login page is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

The script "login1" located in the Forms directory fails to properly sanitize user input data in the login_username field

####################PoC#####################

Proof-of-Concept

http://<PDU IP>/Forms/login1?login_username=<ScRiPt>alert('hello');</ScRiPt>

################Additional#################

Jun 17th 2009 - Vulnerability Discovered

Jun 18th 2009 - Contacted Vendor

Jun 21st 2009 - APC Creates a ticket and enters finding into bug tracking database.

Dec 14th 2009 - APC, no patches released.

###########################################