Community Server Forums 'SearchResults.aspx' Cross-Site Scripting Vulnerability

Bugtraq ID:	14078
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 28 2005 12:00AM
Updated:	Oct 14 2010 05:09PM
Credit:	[email protected]
Vulnerable:	Telligent Systems Community Server :: Forums
Not Vulnerable:

Community Server Forums 'SearchResults.aspx' Cross-Site Scripting Vulnerability

Community Server Forums is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, and disclose or modify sensitive information. Other attacks may also be possible.

Community Server Forums 'SearchResults.aspx' Cross-Site Scripting Vulnerability

The following example URI is available:

• /data/vulnerabilities/exploits/14078.txt

Community Server Forums 'SearchResults.aspx' Cross-Site Scripting Vulnerability

Solution:
Vendor patch is available. Please see the references for more details.

Community Server Forums 'SearchResults.aspx' Cross-Site Scripting Vulnerability

References:

• Community Server :: Forums Homepage (Telligent Systems)
  
• XSS IN Community forum ([email protected])