Vikingboard Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	19916
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 08 2006 12:00AM
Updated:	Sep 18 2006 11:01PM
Credit:	Hessam-x is credited with the discovery of these vulnerabilities.
Vulnerable:	Vikingboard Viking board 0.1b
Not Vulnerable:

Vikingboard Multiple Cross-Site Scripting Vulnerabilities

Vikingboard is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

Version 0.1b is vulnerable; other versions may also be affected.

Vikingboard Multiple Cross-Site Scripting Vulnerabilities

An attacker can exploit this issue using a web client.

The following proof-of-concept URIs are available:

http://www.example.com/help.php?act=[XSS]

http://www.example.com/report.php?p=[XSS]

Vikingboard Multiple Cross-Site Scripting Vulnerabilities

Solution:
The vendor has addressed these issues in the latest SVN repository. Contact the vendor for details on obtaining and applying the appropriate updates.

Vikingboard Multiple Cross-Site Scripting Vulnerabilities

References:

• Vendor Homepage (Vikingboard)
  
• Vikingboard 0.1b Multiple Vulnerabilities (Hessam Salehi)