NEPHP Browse.PHP Cross Site Scripting Vulnerability

Bugtraq ID:	14626
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 22 2005 12:00AM
Updated:	Aug 22 2005 12:00AM
Credit:	bl2k is credited with the discovery of this vulnerability.
Vulnerable:	nePHP nePHP 3.0.4
Not Vulnerable:

NEPHP Browse.PHP Cross Site Scripting Vulnerability

nePHP is prone to a cross-site scripting vulnerability. This issue is due to a lack of sanitization of user-supplied input.

This vulnerability will allow a malicious user to perform attacks on an unsuspecting user in the context of the site hosting the affected application.

This can lead to the theft of cookie-based authentication credentials, as well as other attacks.

NEPHP Browse.PHP Cross Site Scripting Vulnerability

No exploit is required.

The following proof of concept URI is available:

http://www.example.com/nephp/browse.php?mod=find&keywords='%3E%3Cscript%3Ealert('test');%3C/script%3E

NEPHP Browse.PHP Cross Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

NEPHP Browse.PHP Cross Site Scripting Vulnerability

References:

• NeLogic Web Site (NeLogic)
  
• Nephp Publisher Enterprise 3.04 Cross Site Scripting ([email protected])