Taskjitsu Multiple HTML Injection Vulnerabilities

Bugtraq ID:	18818
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 04 2006 12:00AM
Updated:	Jul 05 2006 06:34PM
Credit:	The vendor disclosed these vulnerabilities.
Vulnerable:	PKR Internet Taskjitsu 2.0
Not Vulnerable:	PKR Internet Taskjitsu 2.0.1

Taskjitsu Multiple HTML Injection Vulnerabilities

Taskjitsu is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

These issues affect version 2.0; other versions may also be vulnerable.

Taskjitsu Multiple HTML Injection Vulnerabilities

An attacker can exploit these issues using a web browser.

Taskjitsu Multiple HTML Injection Vulnerabilities

Solution:
The vendor has addressed these issues in version 2.0.1 and later.


PKR Internet Taskjitsu 2.0

• PKR Internet taskjitsu-2.0.3-bin.tar.gz
  http://www.pkrinternet.com/download/taskjitsu-2.0.3-bin.tar.gz

Taskjitsu Multiple HTML Injection Vulnerabilities

References:

• Taskjitsu (PKR Internet)
  
• Taskjitsu Security Advisory (PKR Internet)