obedit Save Function HTML Injection Vulnerability

Bugtraq ID:	25703
Class:	Input Validation Error
CVE:	CVE-2007-4981
Remote:	Yes
Local:	No
Published:	Sep 18 2007 12:00AM
Updated:	May 07 2015 05:35PM
Credit:	Ishkur is credited with the discovery of this vulnerability.
Vulnerable:	Richard Podsada obedit 3.03
Not Vulnerable:	Richard Podsada obedit 3.04b

obedit Save Function HTML Injection Vulnerability

The 'obedit' application is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

This issue affects obedit 3.03; other versions may also be affected.

obedit Save Function HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

obedit Save Function HTML Injection Vulnerability

Solution:
The vendor released obedit 3.04b to address this issue. Please see the references for more information.


Richard Podsada obedit 3.03

• Richard Podsada obedit_3.04b.zip
  http://www.oblius.com/downloads/obedit/obedit_3.04b.zip

obedit Save Function HTML Injection Vulnerability

References:

• obedit Homepage (Richard Podsada)
  
• Re: XSS on Obedit v3.03 ([email protected] )
  
• XSS on Obedit v3.03 ([email protected])