Interchange Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	32297
Class:	Input Validation Error
CVE:	CVE-2008-6945
Remote:	Yes
Local:	No
Published:	Nov 13 2008 12:00AM
Updated:	Apr 16 2015 05:51PM
Credit:	Josh Lavin of Perusion and Mat from Bibliopolis
Vulnerable:	Interchange Interchange 5.5.2 Interchange Interchange 5.5.1 Interchange Interchange 5.4.2 Interchange Interchange 5.4.1 Interchange Interchange 5.6
Not Vulnerable:	Interchange Interchange 5.6.1 Interchange Interchange 5.4.3

Interchange Multiple Cross Site Scripting Vulnerabilities

Interchange is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

Versions prior to Interchange 5.4.3 or 5.6.1 are vulnerable.

Interchange Multiple Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

Interchange Multiple Cross Site Scripting Vulnerabilities

Solution:
The vendor has released an update. Please see the references for more information.

Interchange Multiple Cross Site Scripting Vulnerabilities

References:

• Interchange 5.4.3, 5.6.1, 5.7.1 released (Interchange)
  
• Interchange Homepage (Interchange)