Test ID:	1.3.6.1.4.1.25623.1.0.805694
Category:	Web application abuses
Title:	QNAP TS_x09 Turbo NAS Devices XSS Vulnerability (Jul 2015) - Active Check
Summary:	QNAP TS-x09 Turbo NAS devices are prone to a reflected; cross-site scripting (XSS) vulnerability.
Description:	Summary: QNAP TS-x09 Turbo NAS devices are prone to a reflected cross-site scripting (XSS) vulnerability. Vulnerability Insight: The flaw is due to an input passed via the 'sid' variable in 'cgi-bin/user_index.cgi' and 'cgi-bin/index.cgi' is not properly sanitized. Vulnerability Impact: Successful exploitation will allow remote unauthenticated attacker to inject arbitrary JavaScript which is executed server-side by escaping from the quotation marks. Affected Software/OS: QNAP devices, TS-109 PRO and TS-109 II Version 3.3.0 Build 0924T, TS-209 and TS-209 PRO II Version 3.3.3 Build 1003T, TS-409 and TS-409U Version 3.3.2 Build 0918T. Solution: No known solution was made available for at least one year since the disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.