TTCalc Script Loan And Mortgage HTML Injection Vulnerabilities

Bugtraq ID:	18844
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 05 2006 12:00AM
Updated:	Jul 06 2006 08:24PM
Credit:	luny is credited with discovering these vulnerabilities.
Vulnerable:	TigerTom Scripts TTCalc Script 1.0
Not Vulnerable:

TTCalc Script Loan And Mortgage HTML Injection Vulnerabilities

TTCalc is prone to multiple HTML-injection vulnerabilities because it fails to sanitize input before using it in dynamically generated content.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

TTCalc Script Loan And Mortgage HTML Injection Vulnerabilities

Attackers can exploit these issues through a web client.

TTCalc Script Loan And Mortgage HTML Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].

TTCalc Script Loan And Mortgage HTML Injection Vulnerabilities

References:

• TigerTom Scripts Home Page (TigerTom )
  
• TigerTom Scripts (luny)