KLab HttpLogger Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	26810
Class:	Input Validation Error
CVE:	CVE-2007-6308
Remote:	Yes
Local:	No
Published:	Dec 07 2007 12:00AM
Updated:	Jan 03 2008 02:10PM
Credit:	JVN reported this vulnerability.
Vulnerable:	KLab HttpLogger 0.8.1
Not Vulnerable:	KLab HttpLogger 0.8.2

KLab HttpLogger Unspecified Cross Site Scripting Vulnerability

KLab HttpLogger is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects HttpLogger 0.8.1; other versions may also be vulnerable.

KLab HttpLogger Unspecified Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

KLab HttpLogger Unspecified Cross Site Scripting Vulnerability

Solution:
The vendor has released updates to address this issue. Please see the references for more information.


KLab HttpLogger 0.8.1

• KLab HttpLoggerSetup_082.zip
  http://dsas.blog.klab.org/data/httplogger/HttpLoggerSetup_082.zip

KLab HttpLogger Unspecified Cross Site Scripting Vulnerability

References:

• HttpLogger Release Announcement (KLab)
  
• JVN#02854109 (JVN)