Kantan WEB Server Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	31244
Class:	Input Validation Error
CVE:	CVE-2008-4533
Remote:	Yes
Local:	No
Published:	Sep 18 2008 12:00AM
Updated:	May 07 2015 05:23PM
Credit:	Daiki Fukumori of Secure Sky Technology, Inc.
Vulnerable:	Arihiro Kurata Kantan WEB Server 1.8
Not Vulnerable:	Arihiro Kurata Kantan WEB Server 1.9

Kantan WEB Server Unspecified Cross Site Scripting Vulnerability

Kantan WEB Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Kantan WEB Server 1.9 are vulnerable.

Kantan WEB Server Unspecified Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Kantan WEB Server Unspecified Cross Site Scripting Vulnerability

Solution:
The vendor has released an updated version; please see the references for more information.


Arihiro Kurata Kantan WEB Server 1.8

• Arihiro Kurata kwebs1.9
  http://unyora.sakura.ne.jp/cgi-bin/dlrank2_3/dlranklog.cgi?dl=kwebs1.9

Kantan WEB Server Unspecified Cross Site Scripting Vulnerability

References:

• Kantan WEB Server Homepage (Arihiro Kurata)
  
• JVN#94163107 Kantan WEB Server cross-site scripting vulnerability (JVN)