Noah Grey Greymatter GM-Comments.CGI HTML Injection Vulnerability
BID:12189
Info
Noah Grey Greymatter GM-Comments.CGI HTML Injection Vulnerability
| Bugtraq ID: | 12189 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 06 2005 12:00AM |
| Updated: | Jan 06 2005 12:00AM |
| Credit: | Discovery of this vulnerability is credited to FraMe <[email protected]>. |
| Vulnerable: |
Noah Grey Greymatter 1.21 d Noah Grey Greymatter 1.21 c Noah Grey Greymatter 1.21 b Noah Grey Greymatter 1.21 a Noah Grey Greymatter 1.21 Noah Grey Greymatter 1.3 Noah Grey Greymatter 1.2 Noah Grey Greymatter 1.1 b |
| Not Vulnerable: | |
Discussion
Noah Grey Greymatter GM-Comments.CGI HTML Injection Vulnerability
Greymatter is reportedly affected by an HTML injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input to 'gm-comments.cgi'.
The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user, other attacks are also possible.
Greymatter is reportedly affected by an HTML injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input to 'gm-comments.cgi'.
The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user, other attacks are also possible.
Exploit / POC
Noah Grey Greymatter GM-Comments.CGI HTML Injection Vulnerability
No exploit is required, however the following example inputs to 'gm-comments.cgi' reportedly result in malicious script code being injected:
Name: Your Name
Email:
Homepage:
Content: <iframe src=http://www.example.com/exploit.html </iframe
No exploit is required, however the following example inputs to 'gm-comments.cgi' reportedly result in malicious script code being injected:
Name: Your Name
Email:
Homepage:
Content: <iframe src=http://www.example.com/exploit.html </iframe
Solution / Fix
Noah Grey Greymatter GM-Comments.CGI HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Noah Grey Greymatter GM-Comments.CGI HTML Injection Vulnerability
References:
References:
- Greymatter Product Homepage (Noah Grey)
- Greymatter: Some security flaws (FraMe (frame at kernelpanik.org))