Easy Forum New User Image File HTML Injection Vulnerability

Bugtraq ID:	16958
Class:	Input Validation Error
CVE:	CVE-2006-0877
Remote:	Yes
Local:	No
Published:	Mar 04 2006 12:00AM
Updated:	Mar 08 2006 09:55PM
Credit:	Discovery is credited to Aliaksandr Hartsuyeu.
Vulnerable:	Easy Forum Easy Forum 2.5
Not Vulnerable:

Easy Forum New User Image File HTML Injection Vulnerability

Easy Forum is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

This issue is reported to affect version 2.5. Other versions may also be vulnerable.

Easy Forum New User Image File HTML Injection Vulnerability

These issues can be exploited through use of a web client.

Example 'Image File' data sufficient to demonstrate this issue was provided:
javascript:alert(123) sometext.gif

Easy Forum New User Image File HTML Injection Vulnerability

Solution:
The vendor has re-released version 2.5 with a fix included, and has also released a patch to address this issue.


Easy Forum Easy Forum 2.5

• Easy Forum 'security' fix
  http://hot-things.net/cs/download.php?did=48

Easy Forum New User Image File HTML Injection Vulnerability

References:

• Easy Forum Home Page (Easy Forum)
  
• Easy Forum XSS Vulnerability (Aliaksandr Hartsuyeu)
  
• SORTOF SECURITY HOLE (Easy Forum)
  
• [eVuln] Easy Forum XSS Vulnerability ([email protected])