Barracuda Directory Multiple HTML Injection Vulnerabilities

Bugtraq ID:	16746
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 21 2006 12:00AM
Updated:	Feb 22 2006 07:32PM
Credit:	Discovered by pcps.
Vulnerable:	Boonex Barracuda Directory 1.1
Not Vulnerable:

Barracuda Directory Multiple HTML Injection Vulnerabilities

Barracuda Directory is prone to multiple HTML-injection vulnerabilities. Successful exploitation could result in the execution of arbitrary scripts in the browser of a site administrator.

Attacker-supplied HTML and script code would be executed in the context of the affected site, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

These issues affect Barracuda Directory version 1.1. Other versions may also be vulnerable.

Barracuda Directory Multiple HTML Injection Vulnerabilities


An exploit is not required.

Barracuda Directory Multiple HTML Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Barracuda Directory Multiple HTML Injection Vulnerabilities

References:

• Barracuda Directory (Boonex)