Claudio Criscione

5 exploits Active since Oct 2009
CVE-2009-3759 EXPLOITDB HIGH text WRITEUP
Citrix XenCenterWeb - Cross-Site Request Forgery via Password Change or VM Stop
Multiple cross-site request forgery (CSRF) vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to hijack the authentication of administrators for (1) requests that change the password via the username parameter to config/changepw.php or (2) stop a virtual machine via the stop_vmname parameter to hardstopvm.php. NOTE: some of these details are obtained from third party information.
CVSS 8.8
CVE-2009-3758 EXPLOITDB text WRITEUP
Citrix XenCenterWeb - SQL Injection via login.php Username Parameter
SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.
CVE-2009-3757 EXPLOITDB text WRITEUP
Citrix XenCenterWeb - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to config/edituser.php; (2) location, (3) sessionid, and (4) vmname parameters to console.php; (5) vmrefid and (6) vmname parameters to forcerestart.php; and (7) vmname and (8) vmrefid parameters to forcesd.php. NOTE: some of these details are obtained from third party information.
CVE-2009-3760 EXPLOITDB text WRITEUP
Citrix XenCenterWeb - Remote Code Execution via config/writeconfig.php Pool1 Parameter
Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to inject arbitrary PHP code into include/config.ini.php via the pool1 parameter. NOTE: some of these details are obtained from third party information.
CVE-2009-4849 EXPLOITDB text WRITEUP
ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 - Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new user account via a save action to tvserver/user/user.do, (2) shutdown a virtual machine, (3) start a virtual machine, (4) restart a virtual machine, or (5) schedule an activity.