Perl Nopaste 'language' Parameter HTML Injection Vulnerability

Bugtraq ID:	33036
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 26 2008 12:00AM
Updated:	Jan 02 2009 06:02PM
Credit:	Perl Nopaste
Vulnerable:	Perl Nopaste Perl Nopaste 1.0
Not Vulnerable:	Perl Nopaste Perl Nopaste 1.1

Perl Nopaste 'language' Parameter HTML Injection Vulnerability

Perl Nopaste is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Perl Nopaste 1.0 and prior versions are vulnerable.

Perl Nopaste 'language' Parameter HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Perl Nopaste 'language' Parameter HTML Injection Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.


Perl Nopaste Perl Nopaste 1.0

• Perl Nopaste pnopaste-1.1.tar.gz
  http://downloads.sourceforge.net/pnopaste/pnopaste-1.1.tar.gz?modtime= 1230320273&big_mirror=0

Perl Nopaste 'language' Parameter HTML Injection Vulnerability

References:

• Perl Nopaste Project Page (Perl Nopaste)
  
• Release Name: 1.1 (Perl Nopaste)