FuseTalk Forum IMG Tag HTML Injection Vulnerability
BID:11393
Info
FuseTalk Forum IMG Tag HTML Injection Vulnerability
| Bugtraq ID: | 11393 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 13 2004 12:00AM |
| Updated: | Oct 13 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to "Matthew Oyer" <[email protected]>. |
| Vulnerable: |
FuseTalk Inc. FuseTalk 4.0 |
| Not Vulnerable: | |
Discussion
FuseTalk Forum IMG Tag HTML Injection Vulnerability
FuseTalk Forum is prone to an HTML injection vulnerability. This is because the script that processes posts does not sufficiently sanitize user input, allowing attackers to embed HTML and script commands within the post.
The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user.
FuseTalk Forum is prone to an HTML injection vulnerability. This is because the script that processes posts does not sufficiently sanitize user input, allowing attackers to embed HTML and script commands within the post.
The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user.
Exploit / POC
FuseTalk Forum IMG Tag HTML Injection Vulnerability
The following example is available:
The filtering script for the img src= doesn't filter " if preceded by a ?. The cross site scripting works because the <img src=" tag can be closed by a target URI with " which then permits the user to use such oneventhandles as onmouseover.
The following example is available:
The filtering script for the img src= doesn't filter " if preceded by a ?. The cross site scripting works because the <img src=" tag can be closed by a target URI with " which then permits the user to use such oneventhandles as onmouseover.
Solution / Fix
FuseTalk Forum IMG Tag HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
FuseTalk Forum IMG Tag HTML Injection Vulnerability
References:
References:
- FuseTalk Homepage (FuseTalk Inc.)
- XXS in fusetalk forum ("Matthew Oyer"