BID:33619

Mahara Forum Post Cross Site Scripting Vulnerability

Info

Mahara Forum Post Cross Site Scripting Vulnerability

Bugtraq ID:	33619
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 04 2009 12:00AM
Updated:	Feb 06 2009 05:38PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Mahara Mahara 1.0.8 Mahara Mahara 1.0.6 Mahara Mahara 1.0.5 Mahara Mahara 1.0.4 Mahara Mahara 1.0.3 Mahara Mahara 1.0.2 Mahara Mahara 1.0.1 Mahara Mahara 1.0 Mahara Mahara 0.9.1 Mahara Mahara 0.9

Not Vulnerable:	Mahara Mahara 1.0.9

Discussion

Mahara Forum Post Cross Site Scripting Vulnerability

Mahara is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Mahara 1.0.9 are vulnerable.

Exploit / POC

Mahara Forum Post Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Solution / Fix

Mahara Forum Post Cross Site Scripting Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

Mahara Mahara 0.9