Land Down Under BBCode HTML Injection Vulnerability

Bugtraq ID:	10435
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 29 2004 12:00AM
Updated:	May 29 2004 12:00AM
Credit:	Discovery is credited to Tim De Gier.
Vulnerable:	Land Down Under Land Down Under 700-03 Land Down Under Land Down Under 700-02 Land Down Under Land Down Under 700-01 Land Down Under Land Down Under 602 Land Down Under Land Down Under 601
Not Vulnerable:	Land Down Under Land Down Under 700-05 Land Down Under Land Down Under 700-04

Land Down Under BBCode HTML Injection Vulnerability

Land Down Under is prone to an HTML injection vulnerability. This issue is exposed through their BBCode implementation. Exploitation could permit theft of cookie credentials, manipulation of content, or other attacks.

Land Down Under BBCode HTML Injection Vulnerability

The following example was provided:

[img]javascript:alert(document.cookie);[/img]

Land Down Under BBCode HTML Injection Vulnerability

Solution:
This issue has been addressed in Land Down Under 700-04 and later. Users are advised to upgrade.


Land Down Under Land Down Under 601

• Land Down Under Land Down Under 700-05
  http://ldu.neocrome.net/page.php?id=1357

Land Down Under Land Down Under 602

• Land Down Under Land Down Under 700-05
  http://ldu.neocrome.net/page.php?id=1357

Land Down Under Land Down Under 700-03

• Land Down Under Land Down Under 700-05
  http://ldu.neocrome.net/page.php?id=1357

Land Down Under Land Down Under 700-01

• Land Down Under Land Down Under 700-05
  http://ldu.neocrome.net/page.php?id=1357

Land Down Under Land Down Under 700-02

• Land Down Under Land Down Under 700-05
  http://ldu.neocrome.net/page.php?id=1357

Land Down Under BBCode HTML Injection Vulnerability

References:

• Land Down Under Homepage (Land Down Under)
  
• LDU (land down under) xss vulnerability (tim de gier )