2z Project Multiple Input Validation Vulnerabilities
BID:27057
Info
2z Project Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 27057 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6660 CVE-2007-6661 CVE-2007-6659 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 28 2007 12:00AM |
| Updated: | Jul 05 2016 10:00PM |
| Credit: | Alexandr Polyakov and Stas Svistunovich of DSecRG discovered these issues. |
| Vulnerable: |
2z Project 2z Project 0.9.6 .1 |
| Not Vulnerable: | |
Discussion
2z Project Multiple Input Validation Vulnerabilities
2z Project is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include HTML-injection issues, a cross-site scripting issue, and an arbitrary-file-upload issue.
Attackers can exploit these issues to execute arbitrary HTML and script code in the context of the affected site. Successful exploits could allow an attacker to compromise the application, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks are also possible.
2z Project 0.9.6.1 is vulnerable; other versions may also be affected.
2z Project is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include HTML-injection issues, a cross-site scripting issue, and an arbitrary-file-upload issue.
Attackers can exploit these issues to execute arbitrary HTML and script code in the context of the affected site. Successful exploits could allow an attacker to compromise the application, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks are also possible.
2z Project 0.9.6.1 is vulnerable; other versions may also be affected.
Exploit / POC
2z Project Multiple Input Validation Vulnerabilities
An attacker can use a browser to exploit these issues.
To exploit a cross-site scripting issue, the attacker must entice an unsuspecting user to follow a malicious URI.
The following proof-of-concept URIs are available:
An attacker can use a browser to exploit these issues.
To exploit a cross-site scripting issue, the attacker must entice an unsuspecting user to follow a malicious URI.
The following proof-of-concept URIs are available:
Solution / Fix
2z Project Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
2z Project Multiple Input Validation Vulnerabilities
References:
References:
- 2z Project Homepage (2z Project)
- 2z-project 0.9.6.1 Multiple Security Vulnerabilities ("Digital Security Research Group \[DSecRG\]"