53KF Web IM 'msg' Parameter Cross Site Scripting Vulnerability

Bugtraq ID:	33341
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 19 2009 12:00AM
Updated:	Jan 20 2009 11:42PM
Credit:	xushaopei(xsp)
Vulnerable:	53KF 53KF Web IM Professional Edition 53KF 53KF Web IM Home Edition 53KF 53KF Web IM Enterprise Edition
Not Vulnerable:

53KF Web IM 'msg' Parameter Cross Site Scripting Vulnerability

53KF Web IM is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects the following:

53KF Web IM Home Edition
53KF Web IM Enterprise
53KF Web IM Professional

53KF Web IM 'msg' Parameter Cross Site Scripting Vulnerability

An attacker may exploit this issue using readily available tools.

53KF Web IM 'msg' Parameter Cross Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

53KF Web IM 'msg' Parameter Cross Site Scripting Vulnerability

References:

• 53KF Homepage (53KF)
  
• 53KF Web IM 2009 Cross-Site Scripting Vulnerabilities (Heart )