XOOPS Cube Legacy Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	34346
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 02 2009 12:00AM
Updated:	Apr 02 2009 06:16PM
Credit:	Mr. Ken Mitsui from Bussan Secure Directions Terada and mumin (mumincacao)
Vulnerable:	XOOPS Cube PROJECT XOOPS Cube Legacy 2.1.6
Not Vulnerable:	XOOPS Cube PROJECT XOOPS Cube Legacy 2.1.6 a

XOOPS Cube Legacy Multiple Cross Site Scripting Vulnerabilities

XOOPS Cube Legacy is prone to multiple cross-site scripting vulnerabilities because it fails to adequately sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

Versions prior to XOOPS Cube Legacy 2.1.6a are vulnerable.

XOOPS Cube Legacy Multiple Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

XOOPS Cube Legacy Multiple Cross Site Scripting Vulnerabilities

Solution:
The vendor has released an update to address these issues. Please see the references for more information.

XOOPS Cube Legacy Multiple Cross Site Scripting Vulnerabilities

References:

• Package_Legacy 2.1.6a Release!(Security Fix) (XOOPS Cube Project)
  
• XOOPS Cube Project Homepage (XOOPS Cube Project)
  
• JVN # 74747784 (JVN)