PNG Counter Demo.PHP Cross-Site Scripting Vulnerability
BID:14392
Info
PNG Counter Demo.PHP Cross-Site Scripting Vulnerability
| Bugtraq ID: | 14392 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 26 2005 12:00AM |
| Updated: | Jul 26 2005 12:00AM |
| Credit: | Discovery is credited to ArCaX-ATH <[email protected]>. |
| Vulnerable: |
PNG Counter PNG Counter 1.0 |
| Not Vulnerable: | |
Discussion
PNG Counter Demo.PHP Cross-Site Scripting Vulnerability
PNG Counter is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input that will be output in dynamically generated Web pages.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. The attacker would need to entice the unsuspecting user to follow a malicious link containing script code embedded in the affected parameter. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
PNG Counter 1.0 is vulnerable to this issue.
PNG Counter is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input that will be output in dynamically generated Web pages.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. The attacker would need to entice the unsuspecting user to follow a malicious link containing script code embedded in the affected parameter. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
PNG Counter 1.0 is vulnerable to this issue.
Exploit / POC
PNG Counter Demo.PHP Cross-Site Scripting Vulnerability
An exploit is not required.
A proof of concept URI is available:
http://www.example.com/path/demo.php?digit=">XSS
An exploit is not required.
A proof of concept URI is available:
http://www.example.com/path/demo.php?digit=">XSS
Solution / Fix
PNG Counter Demo.PHP Cross-Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.