Chacmool Private Message System Multiple Vulnerabilities

Bugtraq ID:	11671
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 12 2004 12:00AM
Updated:	Nov 12 2004 12:00AM
Credit:	Discovery is credited to digital ex <[email protected]>.
Vulnerable:	chacmool Private Message System 1.1.3
Not Vulnerable:

Chacmool Private Message System Multiple Vulnerabilities

Private Message System is reported prone to multiple vulnerabilities that can allow remote attackers to carry out cross-site scripting attacks and disclose arbitrary private messages.

Private Message System 1.1.3 is reported vulnerable to these issue, however, it is possible that other version are affected as well.

Chacmool Private Message System Multiple Vulnerabilities

An exploit is not required.

The following proof of concept examples are available:
http://www.example.com/message_send.php?tid=%22><script>alert(document.cookie)</script>
http://www.example.com/message_send.php?quote=[ID]

Chacmool Private Message System Multiple Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Chacmool Private Message System Multiple Vulnerabilities

References:

• Private Message System (chacmool)
  
• Private Messaging System (PMS) Discloses Messages (SecurityTracker)