Agares phpAutoVideo Cross Site Scripting Vulnerability and Remote File Include Vulnerability
BID:27346
Info
Agares phpAutoVideo Cross Site Scripting Vulnerability and Remote File Include Vulnerability
| Bugtraq ID: | 27346 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-0433 CVE-2008-0432 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 18 2008 12:00AM |
| Updated: | Jul 05 2016 10:00PM |
| Credit: | H-T Team is credited with discovering these vulnerabilities. |
| Vulnerable: |
Agares Media phpAutoVideo 2.21 |
| Not Vulnerable: | |
Discussion
Agares phpAutoVideo Cross Site Scripting Vulnerability and Remote File Include Vulnerability
phpAutoVideo is prone to a cross-site scripting vulnerability and a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary code within the context of the webserver process, steal cookie-based authentication credentials, and launch other attacks.
phpAutoVideo 2.21 is vulnerable; other versions may also be affected.
phpAutoVideo is prone to a cross-site scripting vulnerability and a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary code within the context of the webserver process, steal cookie-based authentication credentials, and launch other attacks.
phpAutoVideo 2.21 is vulnerable; other versions may also be affected.
Exploit / POC
Agares phpAutoVideo Cross Site Scripting Vulnerability and Remote File Include Vulnerability
An attacker can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following proof-of-concept URI is available:
An attacker can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following proof-of-concept URI is available:
Solution / Fix
Agares phpAutoVideo Cross Site Scripting Vulnerability and Remote File Include Vulnerability
Solution:
Currently we are not aware of any vendor fixes for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor fixes for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Agares phpAutoVideo Cross Site Scripting Vulnerability and Remote File Include Vulnerability
References:
References: