Noah Grey Greymatter GM-CPLog.CGI HTML Injection Vulnerability
BID:12184
Info
Noah Grey Greymatter GM-CPLog.CGI HTML Injection Vulnerability
| Bugtraq ID: | 12184 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 06 2005 12:00AM |
| Updated: | Jan 06 2005 12:00AM |
| Credit: | Discovery of this vulnerability is credited to FraMe <[email protected]>. |
| Vulnerable: |
Noah Grey Greymatter 1.3 |
| Not Vulnerable: | |
Discussion
Noah Grey Greymatter GM-CPLog.CGI HTML Injection Vulnerability
Noah Grey Greymatter is reportedly affected by an HTML injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input during login.
The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user.
Noah Grey Greymatter is reportedly affected by an HTML injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input during login.
The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user.
Exploit / POC
Noah Grey Greymatter GM-CPLog.CGI HTML Injection Vulnerability
No exploit is required, however the following example inputs to the 'cgi-bin/gm.cgi' login script reportedly result in malicious script content being injected into the affected log:
Author:
<SCRIPT language=JavaScript>alert("XSS")</SCRIPT>
Passwd:
<SCRIPT language=JavaScript>alert("XSS")</SCRIPT>
No exploit is required, however the following example inputs to the 'cgi-bin/gm.cgi' login script reportedly result in malicious script content being injected into the affected log:
Author:
<SCRIPT language=JavaScript>alert("XSS")</SCRIPT>
Passwd:
<SCRIPT language=JavaScript>alert("XSS")</SCRIPT>
Solution / Fix
Noah Grey Greymatter GM-CPLog.CGI HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Noah Grey Greymatter GM-CPLog.CGI HTML Injection Vulnerability
References:
References:
- Greymatter Product Homepage (Noah Grey)
- Greymatter: Some security flaws (FraMe (frame at kernelpanik.org))