Tor World CGI Scripts Unspecified Cross-Site Scripting Vulnerabilities

Bugtraq ID:	27919
Class:	Input Validation Error
CVE:	CVE-2008-0917
Remote:	Yes
Local:	No
Published:	Feb 21 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	These issues were reported by JVN.
Vulnerable:	Tor World Tor Search 1.1 Tor World Tor News 1.21 Tor World Tor Board 1.1 Tor World Simple Vote 1.1 Tor World Simple BBS 1.3 Tor World Quotes of the Day 1.5 Tor World Mobile Frontier 2.1 Tor World Interactive BBS 1.3 Tor World i-Navigator 4.0 Tor World Com Vote 1.2
Not Vulnerable:

Tor World CGI Scripts Unspecified Cross-Site Scripting Vulnerabilities

CGI scripts from Tor World are prone to multiple unspecified cross-site scripting vulnerabilities because they fail to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The vulnerabilities have been reported in the following applications:

Tor Search 1.1 and prior versions
i-Navigator 4.0
Mobile Frontier 2.1 and prior versions
Quotes of the Day 1.5 and prior versions
Tor News 1.21 and prior versions
Simple BBS 1.3. and prior versions
Interactive BBS 1.3 and prior versions
Tor Board 1.1 and prior versions
Simple Vote 1.1 and prior versions
Com Vote 1.2 and prior versions

Tor World CGI Scripts Unspecified Cross-Site Scripting Vulnerabilities

Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.

Tor World CGI Scripts Unspecified Cross-Site Scripting Vulnerabilities

Solution:
The vendor released updates to address this issue. Please see the references for more information.

Tor World CGI Scripts Unspecified Cross-Site Scripting Vulnerabilities

References:

• JVN#54593414 Tor World (JVN)
  
• Tor World Homepage (Tor World)
  
• Tor World Bug (To World)