RETIRED: Polopoly Search Module Cross-Site Scripting Vulnerability

Bugtraq ID:	16007
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 21 2005 12:00AM
Updated:	Sep 28 2006 08:05PM
Credit:	Discovered by rakstija r0t3d3Vil.
Vulnerable:	Polopoly Polopoly 9.0
Not Vulnerable:

RETIRED: Polopoly Search Module Cross-Site Scripting Vulnerability

Polopoly is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This BID is being retired because the vendor claims that the issue affects only a specific section of the vendor's website and is not a part of their product.

RETIRED: Polopoly Search Module Cross-Site Scripting Vulnerability

No exploit is required.

RETIRED: Polopoly Search Module Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

RETIRED: Polopoly Search Module Cross-Site Scripting Vulnerability

References:

• Polopoly Home Page (Polopoly)
  
• Polopoly XSS vuln. (rakstija r0t3d3Vil)