Buddy Zone Multiple HTML Injection Vulnerabilities

Bugtraq ID:	18759
Class:	Input Validation Error
CVE:	CVE-2006-3494
Remote:	Yes
Local:	No
Published:	Jul 01 2006 12:00AM
Updated:	Jul 06 2016 01:33PM
Credit:	luny is credited with the discovery of this vulnerability.
Vulnerable:	Vastal I-Tech Buddy Zone 1.0.1
Not Vulnerable:

Buddy Zone Multiple HTML Injection Vulnerabilities

Buddy Zone is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

This issue affects version 1.0.1.

Buddy Zone Multiple HTML Injection Vulnerabilities

These issues can be exploited through a web client.

Buddy Zone Multiple HTML Injection Vulnerabilities

Solution:
The vendor has announced that a patch is available. Since this is a commercial product, those affected by the vulnerability are encouraged to contact the vendor for support in obtaining and applying the patch.

Buddy Zone Multiple HTML Injection Vulnerabilities

References:

• Buddy Zone Homepage (Vastal I-Tech)
  
• Buddy Zone Version 1.0.1 - XSS (luny)
  
• Re: Buddy Zone Version 1.0.1 - XSS ([email protected])