SSPwiz Plus Cross-Site Scripting Vulnerability
BID:18482
CVE-2006-3079 |Info
SSPwiz Plus Cross-Site Scripting Vulnerability
| Bugtraq ID: | 18482 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-3079 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 16 2006 12:00AM |
| Updated: | Jul 06 2016 01:33PM |
| Credit: | r0t is credited with discovering this vulnerability. |
| Vulnerable: |
SSPwiz SSPwiz 1.0.7 |
| Not Vulnerable: |
SSPwiz SSPwiz 1.1 |
Discussion
SSPwiz Plus Cross-Site Scripting Vulnerability
SSPwiz Plus is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input before displaying it to users of the application.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
SSPwiz Plus is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input before displaying it to users of the application.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Exploit / POC
SSPwiz Plus Cross-Site Scripting Vulnerability
Attackers can exploit this issue by enticing a user to follow a malicious link.
Attackers can exploit this issue by enticing a user to follow a malicious link.
Solution / Fix
SSPwiz Plus Cross-Site Scripting Vulnerability
Solution:
The vendor has addressed this issue in a new version of the application. Please contact the vendor for information on how to obtain the new version.
Solution:
The vendor has addressed this issue in a new version of the application. Please contact the vendor for information on how to obtain the new version.