phpSysInfo Index.php Cross-Site Scripting Vulnerability

Bugtraq ID:	25090
Class:	Input Validation Error
CVE:	CVE-2007-4048
Remote:	Yes
Local:	No
Published:	Jul 27 2007 12:00AM
Updated:	Aug 28 2007 06:12PM
Credit:	Doz is credited with the discovery of this vulnerability.
Vulnerable:	phpSysInfo phpSysInfo 2.5.3 PHPGroupWare PHPGroupWare 0.9.16.011
Not Vulnerable:	PHPGroupWare PHPGroupWare 0.9.16.012

phpSysInfo Index.php Cross-Site Scripting Vulnerability

phpSysInfo is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

phpSysInfo 2.5.3 is reported vulnerable; other versions may be affected as well. Due to a shared codebase phpGroupWare is also affected by this vulnerability

phpSysInfo Index.php Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

phpSysInfo Index.php Cross-Site Scripting Vulnerability

Solution:
phpGroupWare 0.9.16.012 has been released to address this issue.

phpSysInfo Index.php Cross-Site Scripting Vulnerability

References:

• PHPGroupWare Homepage (PHPGroupWare)
  
• phpSysInfo Homepage (phpSysInfo)
  
• Release Name: 0.9.16.012 (PHPGroupWare)