SPIP Research Module Cross-Site Scripting Vulnerability

Bugtraq ID:	17130
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 16 2006 12:00AM
Updated:	Mar 17 2006 10:40PM
Credit:	Amine ABOUD is credited with the discovery of this vulnerability.
Vulnerable:	SPIP SPIP 1.8.2-e
Not Vulnerable:

SPIP Research Module Cross-Site Scripting Vulnerability

SPIP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

SPIP Research Module Cross-Site Scripting Vulnerability


This issue can be exploited with a web browser.

SPIP Research Module Cross-Site Scripting Vulnerability

Solution:

The vendor has addressed this issue in the source.

SPIP Research Module Cross-Site Scripting Vulnerability

References:

• SPIP - Cross-Site Scripting (Amine ABOUD)
  
• SPIP Homepage (SPIP)
  
• Version 1672 (SPIP)