Grayscale BandSite CMS Multiple Input Validation Vulnerabilities

Bugtraq ID:	20137
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 21 2006 12:00AM
Updated:	Sep 22 2006 07:16PM
Credit:	HACKERS PAL is credited with the discovery of these vulnerabilities.
Vulnerable:	Grayscale BandSite CMS 1.1
Not Vulnerable:

Grayscale BandSite CMS Multiple Input Validation Vulnerabilities

Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.

Version 1.1.0 is vulnerable; other versions may also be affected.

Grayscale BandSite CMS Multiple Input Validation Vulnerabilities

An attacker can exploit these issues via a web client.

The following proof-of-concept URIs are available:

• /data/vulnerabilities/exploits/bandsitecms-mult-inp-validation.html

Grayscale BandSite CMS Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Grayscale BandSite CMS Multiple Input Validation Vulnerabilities

References:

• BandSite CMS Web Site (Grayscale)
  
• Grayscale BandSite CMS Multiple Input Validation Vulnerabilities ([email protected])