CPG Dragonfly CMS Linking.PHP HTML Injection Vulnerability

Bugtraq ID:	16781
Class:	Input Validation Error
CVE:	CVE-2006-0726
Remote:	Yes
Local:	No
Published:	Feb 22 2006 12:00AM
Updated:	Feb 23 2006 10:12PM
Credit:	albanialove is credited with the discovery of this vulnerability.
Vulnerable:	CPG Dragonfly Dragonfly CMS 9.0.6 .1
Not Vulnerable:

CPG Dragonfly CMS Linking.PHP HTML Injection Vulnerability

Dragonfly is prone to an HTML-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

CPG Dragonfly CMS Linking.PHP HTML Injection Vulnerability


This vulnerability may be exploited with a web client.

CPG Dragonfly CMS Linking.PHP HTML Injection Vulnerability

Solution:
The vendor has addressed this issue in the latest CVS released. Contact the vendor for details on obtaining the appropriate fixes.

CPG Dragonfly CMS Linking.PHP HTML Injection Vulnerability

References:

• 9.x Forums ? Dragonfly 9.x ? 9.x Blocks/Modules ? Hack on my Site (CPG)
  
• CPG Dragonfly CMS Home Page (CPG)