TYPO3 'KJ: Image Lightbox v2' Extension Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	29384
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 27 2008 12:00AM
Updated:	May 27 2008 12:00AM
Credit:	Michael Raberger
Vulnerable:	Julian Kleinhans KJ: Image Lightbox v2 1.4.2
Not Vulnerable:	Julian Kleinhans KJ: Image Lightbox v2 1.4.3

TYPO3 'KJ: Image Lightbox v2' Extension Unspecified Cross Site Scripting Vulnerability

The KJ: Image Lightbox v2 ('kj_imagelightbox2') extension for TYPO3 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to kj_imagelightbox2 1.1.2 are vulnerable.

TYPO3 'KJ: Image Lightbox v2' Extension Unspecified Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

TYPO3 'KJ: Image Lightbox v2' Extension Unspecified Cross Site Scripting Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

TYPO3 'KJ: Image Lightbox v2' Extension Unspecified Cross Site Scripting Vulnerability

References:

• Synnefoims Homepage (synnefoims)
  
• TYPO3 Security Bulletin TYPO3-20080527-1: Cross Site Scripting vulnerability (Typo3)