VisualShapers EzContents Loginreq2.PHP Cross Site Scripting Vulnerability

Bugtraq ID:	19780
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 30 2006 12:00AM
Updated:	Sep 04 2006 07:23PM
Credit:	DarkFig is credited with discovering this vulnerability.
Vulnerable:	VisualShapers ezContents 2.0.3
Not Vulnerable:

VisualShapers EzContents Loginreq2.PHP Cross Site Scripting Vulnerability

ezContents is prone to a cross-site scripting vulnerability because it fails to sanitize input before displaying it to users of the application.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

VisualShapers EzContents Loginreq2.PHP Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing a user into following a malicious link.

The following proof of concept is available:

• /data/vulnerabilities/exploits/ezcontents-xss-aug302006.html

VisualShapers EzContents Loginreq2.PHP Cross Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please email us at: [email protected]:[email protected].

VisualShapers EzContents Loginreq2.PHP Cross Site Scripting Vulnerability

References:

• ezContents Homepage (Visual Shaper)
  
• ezContents Version 2.0.3 Remote/Local File Inclusion, SQL ( DarkFig)