CuteNews Comment HTML Injection Vulnerability
BID:10750
Info
CuteNews Comment HTML Injection Vulnerability
| Bugtraq ID: | 10750 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 19 2004 12:00AM |
| Updated: | Jul 19 2004 12:00AM |
| Credit: | DarkBicho <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
CutePHP CuteNews 1.3.1 CutePHP CuteNews 1.3 |
| Not Vulnerable: |
CutePHP CuteNews 1.3.2 |
Discussion
CuteNews Comment HTML Injection Vulnerability
CutePHP is reported prone to an HTML injection vulnerability.
The vulnerability exists due to insufficient sanitization of user-supplied input. Specifically, user-supplied input to comment posts are not sufficiently sanitized of malicious HTML code.
An attacker can exploit this vulnerability by adding HTML code within URI arguments. The hostile code may be rendered in the user's browser when the user views the entry.
Exploitation could permit an attacker to steal cookie-based authentication credentials or launch other attacks.
CutePHP is reported prone to an HTML injection vulnerability.
The vulnerability exists due to insufficient sanitization of user-supplied input. Specifically, user-supplied input to comment posts are not sufficiently sanitized of malicious HTML code.
An attacker can exploit this vulnerability by adding HTML code within URI arguments. The hostile code may be rendered in the user's browser when the user views the entry.
Exploitation could permit an attacker to steal cookie-based authentication credentials or launch other attacks.
Exploit / POC
CuteNews Comment HTML Injection Vulnerability
No exploit is required. An example URI sufficient to exploit this vulnerability was provided:
http://www.example.com/show_news.php?subaction=addcomment&name=UserName&comments=http://www.example.com&id=1078525267||1090074219|UserName|none|127.0.0.1|<script>alert("example");</script>||
No exploit is required. An example URI sufficient to exploit this vulnerability was provided:
http://www.example.com/show_news.php?subaction=addcomment&name=UserName&comments=http://www.example.com&id=1078525267||1090074219|UserName|none|127.0.0.1|<script>alert("example");</script>||
Solution / Fix
CuteNews Comment HTML Injection Vulnerability
Solution:
The vendor has released version 1.3.2 that addresses this issue.
CutePHP CuteNews 1.3
CutePHP CuteNews 1.3.1
Solution:
The vendor has released version 1.3.2 that addresses this issue.
CutePHP CuteNews 1.3
-
CutePHP CuteNews Latest Version Download Link
http://cutephp.com/click.php?cutenews_latest
CutePHP CuteNews 1.3.1
-
CutePHP CuteNews Latest Version Download Link
http://cutephp.com/click.php?cutenews_latest
References
CuteNews Comment HTML Injection Vulnerability
References:
References:
- CuteNews Home Page (CutePHP)
- injection html CuteNews (DarkBicho)