PmWiki Multiple HTML Injection Vulnerabilities

Bugtraq ID:	18214
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 01 2006 12:00AM
Updated:	Jun 01 2006 10:27PM
Credit:	Moritz Naumann is credited with the discovery of these vulnerabilities.
Vulnerable:	PmWiki PmWiki 2.1.6
Not Vulnerable:	PmWiki PmWiki 2.1.7

PmWiki Multiple HTML Injection Vulnerabilities

PmWiki is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

This issue affects version 2.1.6; other versions may also be vulnerable.

PmWiki Multiple HTML Injection Vulnerabilities

This issue can be exploited through a web client.

PmWiki Multiple HTML Injection Vulnerabilities

Solution:
The vendor has released version 2.1.7 to address this issue.


PmWiki PmWiki 2.1.6

• PmWiki pmwiki-2.1.7.tgz
  http://www.pmwiki.org/pub/pmwiki/pmwiki-2.1.7.tgz

PmWiki Multiple HTML Injection Vulnerabilities

References:

• PmWiki Download Reference Page (PmWiki)
  
• PmWiki Web Site (PmWiki)