RSMScript Cookie Authentication Bypass and HTML Injection Vulnerabilities
BID:32886
Info
RSMScript Cookie Authentication Bypass and HTML Injection Vulnerabilities
| Bugtraq ID: | 32886 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 16 2008 12:00AM |
| Updated: | Dec 19 2008 08:41PM |
| Credit: | Osirys |
| Vulnerable: |
RSMScript RSMScript 1.21 |
| Not Vulnerable: | |
Discussion
RSMScript Cookie Authentication Bypass and HTML Injection Vulnerabilities
RSMScript is prone to cookie authentication-bypass and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
Exploiting the HTML-injection issue may allow an attacker to execute arbitrary HTML or script code in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. The attacker may exploit the cookie-authentication-bypass issue to gain unauthorized access to the application.
RSMScript 1.21 is vulnerable; other versions may also be affected.
RSMScript is prone to cookie authentication-bypass and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
Exploiting the HTML-injection issue may allow an attacker to execute arbitrary HTML or script code in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. The attacker may exploit the cookie-authentication-bypass issue to gain unauthorized access to the application.
RSMScript 1.21 is vulnerable; other versions may also be affected.
Exploit / POC
RSMScript Cookie Authentication Bypass and HTML Injection Vulnerabilities
Attackers can exploit the issues via a browser. To exploit the HTML-injection issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example URI and code are available:
HTML-Injection example URI:
http://www.example.com/submit.php?quote=<script>alert("XSS")</script>
Cookie-authentication-bypass exploit code:
javascript:document.cookie = "verified=null; path=/";
Attackers can exploit the issues via a browser. To exploit the HTML-injection issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example URI and code are available:
HTML-Injection example URI:
http://www.example.com/submit.php?quote=<script>alert("XSS")</script>
Cookie-authentication-bypass exploit code:
javascript:document.cookie = "verified=null; path=/";
Solution / Fix
RSMScript Cookie Authentication Bypass and HTML Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
RSMScript Cookie Authentication Bypass and HTML Injection Vulnerabilities
References:
References:
- RSMScript Download page (RSMScript)