LooYu Web IM Cross Site Scripting Vulnerability

Bugtraq ID:	31267
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 19 2008 12:00AM
Updated:	Sep 19 2008 11:19PM
Credit:	xisigr[topsec]
Vulnerable:	DuoYou LooYu Web IM Professional 0 DuoYou LooYu Web IM Home Edition 0 DuoYou LooYu Web IM Enterprise 0
Not Vulnerable:

LooYu Web IM Cross Site Scripting Vulnerability

LooYu Web IM is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects the following:

LooYu Web IM Home Edition
LooYu Web IM Enterprise
LooYu Web Professional

LooYu Web IM Cross Site Scripting Vulnerability

An attacker may exploit this issue using readily available tools.

LooYu Web IM Cross Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

LooYu Web IM Cross Site Scripting Vulnerability

References:

• LooYu Homepage (DuoYou)
  
• LooYu Web IM 2008 Cross-Site Scripting Vulnerabilities (xsp )