Learn.com Learncenter.ASP Cross-Site Scripting Vulnerability

Bugtraq ID:	19781
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 30 2006 12:00AM
Updated:	Oct 24 2006 05:53PM
Credit:	Crack_man is credited with the discovery of this vulnerability.
Vulnerable:	learn.com Learncenter 0
Not Vulnerable:

Learn.com Learncenter.ASP Cross-Site Scripting Vulnerability

Learn.com learncenter is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Learn.com Learncenter.ASP Cross-Site Scripting Vulnerability

Attackers can exploit this issue via a web client.

An example URI has been provided:

• /data/vulnerabilities/exploits/learncenter-xss.txt

Learn.com Learncenter.ASP Cross-Site Scripting Vulnerability

Solution:
The vendor reports that this issue has been fixed. Users of affected packages should contact the vendor for more information on obtaining and applying fixes.

Learn.com Learncenter.ASP Cross-Site Scripting Vulnerability

References:

• Learncenter Web Site (learn.com)
  
• XXS in learncenter.asp ([email protected])