Stephen Ostermiller Contact Form Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	24559
Class:	Input Validation Error
CVE:	CVE-2007-3352
Remote:	Yes
Local:	No
Published:	Jun 20 2007 12:00AM
Updated:	Jun 26 2007 11:58PM
Credit:	The vendor reported this issue.
Vulnerable:	Stephen Ostermiller Contact Form 2.0.1 Stephen Ostermiller Contact Form 2.0
Not Vulnerable:	Stephen Ostermiller Contact Form 2.0.2

Stephen Ostermiller Contact Form Unspecified Cross Site Scripting Vulnerability

Contact Form is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Contact Form 2.00.02; other versions may also be affected.

Stephen Ostermiller Contact Form Unspecified Cross Site Scripting Vulnerability

An attacker must entice an unsuspecting victim into following a malicious URI to exploit this issue.

Stephen Ostermiller Contact Form Unspecified Cross Site Scripting Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

Stephen Ostermiller Contact Form Unspecified Cross Site Scripting Vulnerability

References:

• Contact Form Home Page (Stephen Ostermiller)
  
• XSS: apostrophes are not escaped properly in html on preview (Stephen Ostermiller)