GMailSite Cross-Site Scripting Vulnerability
BID:16081
Info
GMailSite Cross-Site Scripting Vulnerability
| Bugtraq ID: | 16081 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 29 2005 12:00AM |
| Updated: | Dec 29 2005 12:00AM |
| Credit: | Discovered by Lostmon. |
| Vulnerable: |
GMailSite GMailSite 1.0.4 GMailSite GMailSite 1.0.3 GMailSite GMailSite 1.0.2 GMailSite GMailSite 1.0.1 GMailSite GMailSite 1.0 GFHost GFHost 0.4.2 GFHost GFHost 0.4.1 GFHost GFHost 0.4 GFHost GFHost 0.3 GFHost GFHost 0.2 GFHost GFHost 0.1.1 |
| Not Vulnerable: | |
Discussion
GMailSite Cross-Site Scripting Vulnerability
GMailSite is prone to a cross-site scripting vulnerability.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
GMailSite 1.0.4 and prior versions are affected by this issue. GFHost 0.4.2 and prior versions are also vulnerable.
GMailSite is prone to a cross-site scripting vulnerability.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
GMailSite 1.0.4 and prior versions are affected by this issue. GFHost 0.4.2 and prior versions are also vulnerable.
Exploit / POC
GMailSite Cross-Site Scripting Vulnerability
No exploit is required.
The following proof of concept examples are available:
http://www.example.com/?lng=es"><script>alert(document.cookie)</script>
http://www.example.com/index.php?lng=es"><script>alert(document.cookie)</script>
No exploit is required.
The following proof of concept examples are available:
http://www.example.com/?lng=es"><script>alert(document.cookie)</script>
http://www.example.com/index.php?lng=es"><script>alert(document.cookie)</script>
Solution / Fix
GMailSite Cross-Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
GMailSite Cross-Site Scripting Vulnerability
References:
References:
- GMailSite Home Page (GMailSite)
- GMailSite variable Cross-Site Scripting and script injection (Lostmon)