DataparkSearch Engine Search Template Cross-Site Scripting Vulnerability

Bugtraq ID:	16572
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 09 2006 12:00AM
Updated:	Feb 09 2006 10:53PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	DataparkSearch DataparkSearch Engine 4.36 DataparkSearch DataparkSearch Engine 4.35 DataparkSearch DataparkSearch Engine 4.34 DataparkSearch DataparkSearch Engine 4.33 DataparkSearch DataparkSearch Engine 4.32 DataparkSearch DataparkSearch Engine 4.31 DataparkSearch DataparkSearch Engine 4.30 DataparkSearch DataparkSearch Engine 4.29 DataparkSearch DataparkSearch Engine 4.28 DataparkSearch DataparkSearch Engine 4.27 DataparkSearch DataparkSearch Engine 4.26 DataparkSearch DataparkSearch Engine 4.25 DataparkSearch DataparkSearch Engine 4.24 DataparkSearch DataparkSearch Engine 4.23 DataparkSearch DataparkSearch Engine 4.22 DataparkSearch DataparkSearch Engine 4.21 DataparkSearch DataparkSearch Engine 4.20 DataparkSearch DataparkSearch Engine 4.19 DataparkSearch DataparkSearch Engine 4.18 DataparkSearch DataparkSearch Engine 4.17 DataparkSearch DataparkSearch Engine 4.16
Not Vulnerable:	DataparkSearch DataparkSearch Engine 4.37

DataparkSearch Engine Search Template Cross-Site Scripting Vulnerability

DataparkSearch Engine is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

DataparkSearch Engine Search Template Cross-Site Scripting Vulnerability

An exploit is not required.

DataparkSearch Engine Search Template Cross-Site Scripting Vulnerability

Solution:
The vendor has released an update to address this issue.


DataparkSearch DataparkSearch Engine 4.25

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.34

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.29

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.28

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.31

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.24

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.23

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.32

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.33

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.26

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.20

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.35

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.27

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.18

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.30

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.22

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.36

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.21

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.17

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.16

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch DataparkSearch Engine 4.19

• DataparkSearch dpsearch-4.37.tar.gz
  http://www.dataparksearch.org/dpsearch-4.37.tar.gz

DataparkSearch Engine Search Template Cross-Site Scripting Vulnerability

References:

• DataparkSearch Engine ChangeLog (DataparkSearch)
  
• DataparkSearch Engine Home Page (DataparkSearch)