Multiple Scriptme Applications BBCode URL Tag Script Injection Vulnerability

Bugtraq ID:	16585
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 10 2006 12:00AM
Updated:	Dec 13 2006 05:53PM
Credit:	Aliaksandr Hartsuyeu is credited with the discovery of this vulnerability.
Vulnerable:	scriptme SmE GB Host 1.21 scriptme SmE Blog Host 0
Not Vulnerable:

Multiple Scriptme Applications BBCode URL Tag Script Injection Vulnerability

Multiple applications from the Scriptme site are prone to a script-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. Other attacks are also possible.

Multiple Scriptme Applications BBCode URL Tag Script Injection Vulnerability

An exploit is not required.

Multiple Scriptme Applications BBCode URL Tag Script Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Multiple Scriptme Applications BBCode URL Tag Script Injection Vulnerability

References:

• Scriptme products BBCode 'url' XSS Vulnerability (eVuln)
  
• SmE Blog Host (scriptme)
  
• SmE GB Host Homepage (scriptme)
  
• [eVuln] Scriptme products BBCode 'url' XSS Vulnerability ([email protected])