mvnForum Quick Reply Feature HTML Injection Vulnerability

Bugtraq ID:	29075
Class:	Input Validation Error
CVE:	CVE-2008-2131
Remote:	Yes
Local:	No
Published:	May 06 2008 12:00AM
Updated:	May 07 2015 05:29PM
Credit:	Christian Holler
Vulnerable:	MyVietnam mvnForum 1.1 GA
Not Vulnerable:

mvnForum Quick Reply Feature HTML Injection Vulnerability

mvnForum is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

mvnForum 1.1 is vulnerable; other versions may also be affected.

mvnForum Quick Reply Feature HTML Injection Vulnerability

Attackers can exploit this issue via a browser.

mvnForum Quick Reply Feature HTML Injection Vulnerability

Solution:
The vendor has committed fixes for this issue to their CVS source code repository. Please see the references for more information.

mvnForum Quick Reply Feature HTML Injection Vulnerability

References:

• mvnForum Homepage (mvnForum)
  
• mvnForum revision 1.316 (MyVietnam)
  
• mvnForum 1.1 Cross Site Scripting ([email protected])