LightNEasy Multiple HTML Injection Vulnerabilities

Bugtraq ID:	35229
Class:	Input Validation Error
CVE:	CVE-2009-1937
Remote:	Yes
Local:	No
Published:	Jun 04 2009 12:00AM
Updated:	Apr 13 2015 09:10PM
Credit:	InterN0T
Vulnerable:	LightNEasy LightNEasy SQLite 2.2.2 LightNEasy LightNEasy no database 2.2.1 LightNEasy LightNEasy 3.2.4 LightNEasy LightNEasy 3.1.1
Not Vulnerable:

LightNEasy Multiple HTML Injection Vulnerabilities

LightNEasy is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

The following are affected:

LightNEasy 2.2.1 no database
LightNEasy 2.2.2 SQLite
LightNEasy 3.1.1

LightNEasy Multiple HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

LightNEasy Multiple HTML Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

LightNEasy Multiple HTML Injection Vulnerabilities

References:

• LightNEasy - HTML Injection Vulnerability (InterN0T)
  
• LightNEasy Homepage (LightNEasy)
  
• SSCHADV2011-013: Multiple XSS vulnerabilities in LightNEasy (Stefan Schurtz)
  
• XSS vulnerability in LightNEasy CMS (High-Tech Bridge)