Snitz Forums 2000 Forum.ASP Cross-Site Scripting Vulnerability

Bugtraq ID:	20004
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 13 2006 12:00AM
Updated:	Sep 14 2006 05:52PM
Credit:	ajann is credited with the discovery of this vulnerability.
Vulnerable:	Snitz Forums 2000 Snitz Forums 2000 3.4.6
Not Vulnerable:

Snitz Forums 2000 Forum.ASP Cross-Site Scripting Vulnerability

Snitz Forums 2000 is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

This could allow an attacker to steal cookie-based authentication credentials and launch other attacks.

Version 3.4.06 is vulnerable; other versions may also be affected.

Snitz Forums 2000 Forum.ASP Cross-Site Scripting Vulnerability

An attacker can exploit this issue via a web client.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/20004.html

Snitz Forums 2000 Forum.ASP Cross-Site Scripting Vulnerability

Solution:
The vendor has updated version 3.4.06 to address this issue.

Please see the references section for more information.


Snitz Forums 2000 Snitz Forums 2000 3.4.6

• Snitz Forums 2000 Snitz Forums 2000 Lasest Version Download Link
  This link will download the latest version of Snitz Forums 2000
  http://forum.snitz.com/download.asp

Snitz Forums 2000 Forum.ASP Cross-Site Scripting Vulnerability

References:

• Snitz Forums 2000 Homepage (Snitz Forums 2000)
  
• Re: Snitz Forums 2000 v3.4.06 ([email protected])
  
• Snitz Forums 2000 v3.4.06 (ajann)