phpg Multiple Input Validation Vulnerabilities
BID:32963
Info
phpg Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 32963 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 21 2008 12:00AM |
| Updated: | Feb 06 2009 06:38PM |
| Credit: | Anarchy Angel |
| Vulnerable: |
Black Dwarf phpg 1.6 |
| Not Vulnerable: |
Black Dwarf phpg 1.7 |
Discussion
phpg Multiple Input Validation Vulnerabilities
The 'phpg' program is prone to multiple input-validation vulnerabilities:
- A script-injection vulnerability
- A denial-of-service vulnerability
- Multiple cross-site-scripting vulnerabilities
An attacker can exploit these issues to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, or create a denial-of-service condition.
These issues affect phpg 1.6; other versions may also be affected.
The 'phpg' program is prone to multiple input-validation vulnerabilities:
- A script-injection vulnerability
- A denial-of-service vulnerability
- Multiple cross-site-scripting vulnerabilities
An attacker can exploit these issues to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, or create a denial-of-service condition.
These issues affect phpg 1.6; other versions may also be affected.
Exploit / POC
phpg Multiple Input Validation Vulnerabilities
Attackers can exploit these issues through a browser. To exploit the cross-site scripting vulnerabilities, an attacker must entice an unsuspecting victim to follow a malicious URI.
The following examples are available:
Attackers can exploit these issues through a browser. To exploit the cross-site scripting vulnerabilities, an attacker must entice an unsuspecting victim to follow a malicious URI.
The following examples are available:
Solution / Fix
phpg Multiple Input Validation Vulnerabilities
Solution:
The vendor indicates that this issue has been resolved in phpg 1.7. Please see the references for more information.
Black Dwarf phpg 1.6
Solution:
The vendor indicates that this issue has been resolved in phpg 1.7. Please see the references for more information.
Black Dwarf phpg 1.6
-
Black Dwarf phpg_v1.7.zip
http://www.black-dwarf.com/phpg/download-phpg.php