�?ilem Haber Free Edition Hata.ASP Cross-Site Scripting Vulnerability

Bugtraq ID:	21511
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 08 2006 12:00AM
Updated:	Dec 12 2006 09:18PM
Credit:	ShaFuck31 is credited with the discovery of this vulnerability.
Vulnerable:	Aspindir �?ilem Haber Free Edition 0
Not Vulnerable:

�?ilem Haber Free Edition Hata.ASP Cross-Site Scripting Vulnerability

Ã?ilem Haber Free Edition is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

�?ilem Haber Free Edition Hata.ASP Cross-Site Scripting Vulnerability

An attacker can trigger this vulnerability by enticing a victim user to follow a malicious URI.

An example URI has been provided:

http://www.example.com/[path to script]/editor_haber/hata.asp?hata=[XSS]

�?ilem Haber Free Edition Hata.ASP Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any solutions for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

�?ilem Haber Free Edition Hata.ASP Cross-Site Scripting Vulnerability

References:

• �?ilem Haber Free Edition Homepage (Aspindir)
  
• ?ilem Haber Free-Edition (tr) Xss Vuln. ( ShaFuck31)