MaviPortal Arama.ASP Cross-Site Scripting Vulnerability

Bugtraq ID:	21512
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 09 2006 12:00AM
Updated:	Dec 12 2006 09:18PM
Credit:	St@rExT is credited with the discovery of this vulnerability.
Vulnerable:	MaviPortal MaviPortal 0
Not Vulnerable:

MaviPortal Arama.ASP Cross-Site Scripting Vulnerability

MaviPortal is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MaviPortal Arama.ASP Cross-Site Scripting Vulnerability

An attacker can trigger this vulnerability by enticing a victim user to follow a malicious URI.

An example URI has been provided:

http://www.example.com/[scriptoath]/arama.asp?a_r_a_n_a_c_a_k= [xss Code]

MaviPortal Arama.ASP Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any solutions for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

MaviPortal Arama.ASP Cross-Site Scripting Vulnerability

References:

• MaviPortal Homepage (MaviPortal)