e107 Subject field HTML injection Vulnerability
BID:18560
CVE-2006-3259 |Info
e107 Subject field HTML injection Vulnerability
| Bugtraq ID: | 18560 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 21 2006 12:00AM |
| Updated: | Jun 21 2006 08:45PM |
| Credit: | EllipSiS Security discovered this issue. |
| Vulnerable: |
e107 e107 website system 0.7.5 |
| Not Vulnerable: | |
Discussion
e107 Subject field HTML injection Vulnerability
The e107 CMS is prone to an HTML-injection vulnerability.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site when the inserted data is viewed.
The e107 CMS is prone to an HTML-injection vulnerability.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site when the inserted data is viewed.
Exploit / POC
e107 Subject field HTML injection Vulnerability
This issue can be exploited through a web client.
A proof of concept is available.
This issue can be exploited through a web client.
A proof of concept is available.
Solution / Fix
e107 Subject field HTML injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].
References
e107 Subject field HTML injection Vulnerability
References:
References:
- e107 website system Homepage (e107.org)
- Ellipsis Security (Ellipsis Security)