YourFreeWorld Short Url & Url Tracker Script Multiple HTML Injection Vulnerabilities

Bugtraq ID:	18046
Class:	Input Validation Error
CVE:	CVE-2006-2509 CVE-2006-2510
Remote:	Yes
Local:	No
Published:	May 19 2006 12:00AM
Updated:	Mar 26 2008 04:19PM
Credit:	luny is credited with the discovery of these vulnerabilities.
Vulnerable:	YourFreeWorld Short Url & Url Tracker Script 0
Not Vulnerable:

YourFreeWorld Short Url & Url Tracker Script Multiple HTML Injection Vulnerabilities

Short Url & Url Tracker Script is prone to multiple HTML-injection vulnerabilities because the software fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

YourFreeWorld Short Url & Url Tracker Script Multiple HTML Injection Vulnerabilities

Attackers may launch attacks through a browser.

YourFreeWorld Short Url & Url Tracker Script Multiple HTML Injection Vulnerabilities

Solution:
The vendor has released updates. Please contact the vendor for details.

YourFreeWorld Short Url & Url Tracker Script Multiple HTML Injection Vulnerabilities

References:

• Short Url & Url Tracker Script (YourFreeWorld)
  
• Yourfreeworld.com Short Url & Url Tracker Script (luny)