Retired: PHPSlideShow Toonchapter8.php Cross Site Scripting Vulnerability
BID:26576
Info
Retired: PHPSlideShow Toonchapter8.php Cross Site Scripting Vulnerability
| Bugtraq ID: | 26576 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6135 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 26 2007 12:00AM |
| Updated: | May 12 2015 07:49PM |
| Credit: | Jose Luis Góngora Fernández is credited with the discovery of this vulnerability. |
| Vulnerable: |
PHPSlideShow PHPSlideShow 0.9.9 .2 |
| Not Vulnerable: | |
Discussion
Retired: PHPSlideShow Toonchapter8.php Cross Site Scripting Vulnerability
PHPSlideShow is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
NOTE: Reports indicate that the vulnerable script does not exist in the affected application. Therefore, this BID is being retired.
PHPSlideShow is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
NOTE: Reports indicate that the vulnerable script does not exist in the affected application. Therefore, this BID is being retired.
Exploit / POC
Retired: PHPSlideShow Toonchapter8.php Cross Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim into following a malicious URI.
The following proof-of-concept URI is available:
http://www.example.com/PATH/toonchapter8.php?directory=[XSS]
An attacker can exploit this issue by enticing an unsuspecting victim into following a malicious URI.
The following proof-of-concept URI is available:
http://www.example.com/PATH/toonchapter8.php?directory=[XSS]
Solution / Fix
Retired: PHPSlideShow Toonchapter8.php Cross Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Retired: PHPSlideShow Toonchapter8.php Cross Site Scripting Vulnerability
References:
References:
- PHPSlideShow Homepage (PHPSlideShow)