Olate Download FLDM.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	25412
Class:	Input Validation Error
CVE:	CVE-2007-4541
Remote:	Yes
Local:	No
Published:	Aug 22 2007 12:00AM
Updated:	May 07 2015 05:35PM
Credit:	imei Addmimistrator is credited with the discovery of this vulnerability.
Vulnerable:	Olate Download 3.4.2
Not Vulnerable:	Olate Download 3.4.3

Olate Download FLDM.PHP Cross-Site Scripting Vulnerability

Olate Download is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Olate Download 3.4.2 is vulnerable; prior versions may also be affected.

Olate Download FLDM.PHP Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Olate Download FLDM.PHP Cross-Site Scripting Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.


Olate Download 3.4.2

• Olate OlateDownload-3.4.3.tar.gz
  http://downloads.sourceforge.net/olatedownload/OlateDownload-3.4.3.tar .gz?modtime=1191820704&big_mirror=0

Olate Download FLDM.PHP Cross-Site Scripting Vulnerability

References:

• Olate Download 3.4.2~modules/core/fldm.php~comments tag [url] XSS (imei Addmimistrator)
  
• Olate Download 3.4.3 Release Notes (Olate)
  
• Olate Download Homepage (Olate)
  
• Olate Download 3.4.2~modules/core/fldm.php~comments tag [url] XSS ([email protected])