Snitz Forums Register Script HTML Injection Vulnerability

Bugtraq ID:	10564
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 17 2004 12:00AM
Updated:	Jun 17 2004 12:00AM
Credit:	Discovery is credited to Pete Foster <[email protected]>.
Vulnerable:	Snitz Forums 2000 Snitz Forums 2000 3.4 .04 Snitz Forums 2000 Snitz Forums 2000 3.4 .03 Snitz Forums 2000 Snitz Forums 2000 3.4 .02 Snitz Forums 2000 Snitz Forums 2000 3.3 .03 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Snitz Forums 2000 Snitz Forums 2000 3.3 .02 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Snitz Forums 2000 Snitz Forums 2000 3.3 .01 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Snitz Forums 2000 Snitz Forums 2000 3.3 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Snitz Forums 2000 Snitz Forums 2000 3.1 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Snitz Forums 2000 Snitz Forums 2000 3.0 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0
Not Vulnerable:

Snitz Forums Register Script HTML Injection Vulnerability

Snitz Forums is prone to an HTML injection vulnerability. User-supplied data through the 'Email' field of 'register.asp' script is not properly sanitized. It is reported that an attacker can supply malicious HTML or script code through this field that will be posted on a vulnerable forum.

Snitz Forums versions 3.4.04 and prior are affected by this issue.

Snitz Forums Register Script HTML Injection Vulnerability

No exploit is required.

Snitz Forums Register Script HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Snitz Forums Register Script HTML Injection Vulnerability

References:

• Fix Information - pop_mail.asp (Snitz Forums 2000)
  
• Snitz Forums 2000 Homepage (Snitz Forums 2000)
  
• XSS in Snitz Forum 2000 ("Pete Foster" )