Nuke ET Journal Module Security Bypass and HTML Injection Vulnerabilities

Bugtraq ID:	29080
Class:	Input Validation Error
CVE:	CVE-2008-2134 CVE-2008-2133
Remote:	Yes
Local:	No
Published:	May 07 2008 12:00AM
Updated:	Jul 06 2016 02:17PM
Credit:	mrzayas
Vulnerable:	Tru-Zone NukeET 3.2 Tru-Zone NukeET 3.1 Tru-Zone NukeET 3.0 Tru-Zone NukeET 3.9 Tru-Zone NukeET 3.4 Tru-Zone NukeET 3.3
Not Vulnerable:	Tru-Zone NukeET 3.10

Nuke ET Journal Module Security Bypass and HTML Injection Vulnerabilities

Nuke ET is prone to a security-bypass vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, control how the site is rendered to the user, or perform unauthorized actions as another user; other attacks may also be possible.

Versions prior to Nuke ET 3.10 are vulnerable.

Nuke ET Journal Module Security Bypass and HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

Nuke ET Journal Module Security Bypass and HTML Injection Vulnerabilities

Solution:
The vendor has released an update. Please see the references for more information.

Nuke ET Journal Module Security Bypass and HTML Injection Vulnerabilities

References:

• Nuke ET Fix 10 (Tru-Zone)
  
• Vendor Homepage (Tru-Zone)