Positive Software Corporation SiteStudio HTML Injection Vulnerability

Bugtraq ID:	13554
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 09 2005 12:00AM
Updated:	May 09 2005 12:00AM
Credit:	Discovery is credited to Donnie Werner.
Vulnerable:	Positive Software Corporation SiteStudio 1.6 Patch 1 Positive Software Corporation SiteStudio 1.6 Final
Not Vulnerable:

Positive Software Corporation SiteStudio HTML Injection Vulnerability

SiteStudio is prone to an HTML injection vulnerability.

Attacker-supplied HTML and script code may be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

Positive Software Corporation SiteStudio HTML Injection Vulnerability

An exploit is not required.

Positive Software Corporation SiteStudio HTML Injection Vulnerability

Solution:
Patches for SiteStudio 1.6 Final and 1.6 Patch 1 have been released. Please see the following site for more information:

http://www.psoft.net/SS/ss_16_security_update_guestbook.html

Positive Software Corporation SiteStudio HTML Injection Vulnerability

References:

• SiteStudio (Positive Software Corporation)