PHPSimpleChoose Multiple HTML Injection Vulnerabilities

Bugtraq ID:	18408
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 13 2006 12:00AM
Updated:	Jun 14 2006 05:21PM
Credit:	Luny is credited with discovering this vulnerability
Vulnerable:	PHPSimpleChoose PHPSimpleChoose 0.3
Not Vulnerable:

PHPSimpleChoose Multiple HTML Injection Vulnerabilities

PHPSimpleChoose is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied HTML and script code before using it in dynamically generated content.

An attacker could exploit this vulnerability to inject hostile HTML and script code into the browser session of other users of the application or to control how the site is rendered; other attacks are also possible.

PHPSimpleChoose Multiple HTML Injection Vulnerabilities

This issue can be exploited with a web browser.

PHPSimpleChoose Multiple HTML Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

PHPSimpleChoose Multiple HTML Injection Vulnerabilities

References:

• PHPSimpleChoose Homepage (PHPSimpleChoose)
  
• PHPSimpleChoose (Luny)