Jan Erdmann Jebuch HTML Injection Vulnerability
BID:11463
Info
Jan Erdmann Jebuch HTML Injection Vulnerability
| Bugtraq ID: | 11463 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 19 2004 12:00AM |
| Updated: | Oct 19 2004 12:00AM |
| Credit: | PuWu disclosed this vulnerability. |
| Vulnerable: |
Jan Erdmann Jebuch 1.0 |
| Not Vulnerable: | |
Discussion
Jan Erdmann Jebuch HTML Injection Vulnerability
It is reported that Jebuch is susceptible to an HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.
This may allow an attacker to inject malicious HTML and script code into the application. An unsuspecting user viewing a page that contains the malicious embedded code will have the attacker-supplied script executed within their browser in the context of the vulnerable site. This issue may be leveraged to steal cookie based authentication credentials. Other attacks are also possible.
Version 1.0 of Jebuch is reported vulnerable to this issue.
It is reported that Jebuch is susceptible to an HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.
This may allow an attacker to inject malicious HTML and script code into the application. An unsuspecting user viewing a page that contains the malicious embedded code will have the attacker-supplied script executed within their browser in the context of the vulnerable site. This issue may be leveraged to steal cookie based authentication credentials. Other attacks are also possible.
Version 1.0 of Jebuch is reported vulnerable to this issue.
Exploit / POC
Jan Erdmann Jebuch HTML Injection Vulnerability
An exploit is not required. An example BBCode tag sufficient to test this vulnerability has been provided:
[img]"?" onError="window.location='http://www.example.com'"[/img]
An exploit is not required. An example BBCode tag sufficient to test this vulnerability has been provided:
[img]"?" onError="window.location='http://www.example.com'"[/img]
Solution / Fix
Jan Erdmann Jebuch HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Jan Erdmann Jebuch HTML Injection Vulnerability
References:
References:
- Jebuch BBCode Image Tag Input Validation Flaw Lets Remote Users Conduct Cross-Si (SecurityTracker)
- Jebuch Home Page (Jan Erdmann)