Novemberborn sIFR 'txt' Parameter Cross-Site Scripting Vulnerability

Bugtraq ID:	27394
Class:	Input Validation Error
CVE:	CVE-2008-0438
Remote:	Yes
Local:	No
Published:	Jan 22 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	Jan Fry of ProCheckUp Ltd and Arseny Vesnin discovered this vulnerability.
Vulnerable:	Novemberborn sIFR 2.0.2 Novemberborn sIFR 3
Not Vulnerable:	Novemberborn sIFR 2.0.3 Novemberborn sIFR 3r278

Novemberborn sIFR 'txt' Parameter Cross-Site Scripting Vulnerability

Novemberborn sIFR is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to sIFR 2.0.3 and 3r278 are vulnerable.

Novemberborn sIFR 'txt' Parameter Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/27394.html

Novemberborn sIFR 'txt' Parameter Cross-Site Scripting Vulnerability

Solution:
The vendor released sIFR 2.0.3 and 3r278 to address this issue. However, the vendor recommends that users of of sIFR 2 upgrade to 2.0.5. Please see the references for more information.


Novemberborn sIFR 3

• sIFR sifr3-r278.zip
  http://dev.novemberborn.net/sifr3/nightlies/sifr3-r278.zip

Novemberborn sIFR 2.0.2

• sIFR sIFR-2.0.3.zip
  http://novemberborn.net/sifr/2.0.3/sIFR-2.0.3.zip

Novemberborn sIFR 'txt' Parameter Cross-Site Scripting Vulnerability

References:

• sIFR 2.0.3 Security Update (Novemberborn)
  
• sIFR 3 Revision 278 Security Update (Novemberborn)
  
• sIFR Homepage (Novemberborn)
  
• PR07-38: XSS on sIFR (ProCheckUp Research )