PHPScheduleIt HTML Injection Vulnerability

Bugtraq ID:	11080
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 31 2004 12:00AM
Updated:	Aug 31 2004 12:00AM
Credit:	Joxean Koret <[email protected]> disclosed this vulnerability.
Vulnerable:	phpScheduleIt phpScheduleIt 1.0 .0RC1
Not Vulnerable:	phpScheduleIt phpScheduleIt 1.0

PHPScheduleIt HTML Injection Vulnerability

phpScheduleIt is reported to contain an HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input before including it in dynamically generated web page content.

This may allow an attacker to inject malicious HTML and script code into the application. An unsuspecting user viewing the schedule will have the attacker-supplied script code executed within their browser in the context of the vulnerable site. This issue may be leverage to steal cookie based authentication credentials. Other attacks are also possible.

Although this issue reportedly affects version 1.0.0RC1 of the affected software, it is likely that other versions are affected as well.

PHPScheduleIt HTML Injection Vulnerability

An exploit is not required.

PHPScheduleIt HTML Injection Vulnerability

Solution:
The vendor has released an update to address this vulnerability:


phpScheduleIt phpScheduleIt 1.0 .0RC1

• phpScheduleIt phpScheduleIt_1.0.0.tar.gz
  http://sourceforge.net/project/showfiles.php?group_id=95547&package_id =101920&release_id=267509

PHPScheduleIt HTML Injection Vulnerability

References:

• phpScheduleIt Home Page (phpScheduleIt)
  
• Multiple Vulnerabilities in phpScheduleIt (Joxean Koret )
  
• Re: Multiple Vulnerabilities in phpScheduleIt (Nick Korbel )