BID:27678

LinPHA Multiple Cross-Site Scripting Vulnerabilities

Info

LinPHA Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	27678
Class:	Input Validation Error
CVE:	CVE-2008-7223
Remote:	Yes
Local:	No
Published:	Feb 07 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	The vendor disclosed these issues.
Vulnerable:	LinPHA LinPHA 1.3.2 LinPHA LinPHA 1.3.1 LinPHA LinPHA 1.3 LinPHA LinPHA 1.1.1 LinPHA LinPHA 1.1 LinPHA LinPHA 0.9.4 LinPHA LinPHA 0.9.3 LinPHA LinPHA 0.9.2 LinPHA LinPHA 0.9.1 LinPHA LinPHA 0.9 .0 LinPHA LinPHA 1.0

Not Vulnerable:	LinPHA LinPHA 1.3.3

Discussion

LinPHA Multiple Cross-Site Scripting Vulnerabilities

LinPHA is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Attackers can leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help attackers steal cookie-based authentication credentials and launch other attacks.

Versions prior to LinPHA 1.3.3 are vulnerable.

Exploit / POC

LinPHA Multiple Cross-Site Scripting Vulnerabilities

An attacker must entice a unsuspecting victim into following a malicious URI to exploit this issue.

Solution / Fix

LinPHA Multiple Cross-Site Scripting Vulnerabilities

Solution:
The vendor released LinPHA 1.3.3 to address these issues. Please see the references for more information.

LinPHA LinPHA 1.0