PMachine ExpressionEngine HTTP Referrer HTML Injection Vulnerability
BID:16377
Info
PMachine ExpressionEngine HTTP Referrer HTML Injection Vulnerability
| Bugtraq ID: | 16377 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 25 2006 12:00AM |
| Updated: | Jul 05 2006 09:14PM |
| Credit: | Aliaksandr Hartsuyeu is credited with the discovery of this vulnerability. |
| Vulnerable: |
PMachine ExpressionEngine 1.4.1 |
| Not Vulnerable: |
PMachine ExpressionEngine 1.4.2 |
Discussion
PMachine ExpressionEngine HTTP Referrer HTML Injection Vulnerability
ExpressionEngine is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to HTTP 'Referer' header before using it in dynamically generated content.
Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
ExpressionEngine is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to HTTP 'Referer' header before using it in dynamically generated content.
Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
Exploit / POC
PMachine ExpressionEngine HTTP Referrer HTML Injection Vulnerability
An exploit is not required.
An example exploit has been provided:
GET /path/index.php HTTP/1.0
Host: host
Referer: http://<XSS>.com/;
An exploit is not required.
An example exploit has been provided:
GET /path/index.php HTTP/1.0
Host: host
Referer: http://<XSS>.com/;
Solution / Fix
PMachine ExpressionEngine HTTP Referrer HTML Injection Vulnerability
Solution:
The vendor has released version 1.4.2 to correct this issue.
Solution:
The vendor has released version 1.4.2 to correct this issue.
References
PMachine ExpressionEngine HTTP Referrer HTML Injection Vulnerability
References:
References: