Gossamer Threads Links Multiple HTML Injection Vulnerabilities
BID:14160
Info
Gossamer Threads Links Multiple HTML Injection Vulnerabilities
| Bugtraq ID: | 14160 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 07 2005 12:00AM |
| Updated: | Jun 07 2005 12:00AM |
| Credit: | The individual or individuals responsible for the discovery of this issue are currently unknown; the vendor disclosed this issue. |
| Vulnerable: |
Gossamer Threads Links-SQL 3.0.3 Gossamer Threads Links-SQL 3.0.2 Gossamer Threads Links-SQL 3.0.1 Gossamer Threads Links-SQL 3.0 |
| Not Vulnerable: |
Gossamer Threads Links-SQL 3.0.4 |
Discussion
Gossamer Threads Links Multiple HTML Injection Vulnerabilities
Gossamer Threads Links is prone to multiple HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
The vendor has addressed these issues in Gossamer Threads Links version 3.0.4; earlier versions are reported vulnerable.
Gossamer Threads Links is prone to multiple HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
The vendor has addressed these issues in Gossamer Threads Links version 3.0.4; earlier versions are reported vulnerable.
Exploit / POC
Gossamer Threads Links Multiple HTML Injection Vulnerabilities
No exploit is required.
No exploit is required.
Solution / Fix
Gossamer Threads Links Multiple HTML Injection Vulnerabilities
Solution:
The vendor has addressed these issues in Gossamer Threads Links version 3.0.4:
Gossamer Threads Links-SQL 3.0
Gossamer Threads Links-SQL 3.0.1
Gossamer Threads Links-SQL 3.0.2
Gossamer Threads Links-SQL 3.0.3
Solution:
The vendor has addressed these issues in Gossamer Threads Links version 3.0.4:
Gossamer Threads Links-SQL 3.0
-
Gossamer Threads Gossamer Threads Links 3.0.4
http://www.gossamer-threads.com/scripts/links-sql/download.htm
Gossamer Threads Links-SQL 3.0.1
-
Gossamer Threads Gossamer Threads Links 3.0.4
http://www.gossamer-threads.com/scripts/links-sql/download.htm
Gossamer Threads Links-SQL 3.0.2
-
Gossamer Threads Gossamer Threads Links 3.0.4
http://www.gossamer-threads.com/scripts/links-sql/download.htm
Gossamer Threads Links-SQL 3.0.3
-
Gossamer Threads Gossamer Threads Links 3.0.4
http://www.gossamer-threads.com/scripts/links-sql/download.htm
References
Gossamer Threads Links Multiple HTML Injection Vulnerabilities
References:
References:
- Gossamer Links 3.0.4 release notes. (Gossamer Threads)
- Links-SQL Home Page (Gossamer Threads)