aMember Multiple Cross Site Scripting And HTML Injection Vulnerabilities

Bugtraq ID:	35089
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 25 2009 12:00AM
Updated:	Jun 02 2009 10:39PM
Credit:	InterN0T
Vulnerable:	CGI Central AMember 3.1.7
Not Vulnerable:	CGI Central AMember 3.1.8

aMember Multiple Cross Site Scripting And HTML Injection Vulnerabilities

aMember is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

aMember 3.1.7 is vulnerable; other versions may also be affected.

aMember Multiple Cross Site Scripting And HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.

The following example data and URIs are available:

• /data/vulnerabilities/exploits/35089.html

aMember Multiple Cross Site Scripting And HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references for details.

aMember Multiple Cross Site Scripting And HTML Injection Vulnerabilities

References:

• AMember Home Page (CGI Central)
  
• aMember Pro 3.1.8 (security fix) released (aMember)
  
• [InterN0T] AMember 3.1.7 - Multiple Vulnerabilities ([email protected])