TYPO3 Modern Guestbook / Commenting System Extension Unspecified Cross Site Scripting Vulnerability
BID:35397
Info
TYPO3 Modern Guestbook / Commenting System Extension Unspecified Cross Site Scripting Vulnerability
| Bugtraq ID: | 35397 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-2104 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 16 2009 12:00AM |
| Updated: | Jun 23 2009 08:39PM |
| Credit: | Alexander Kellner |
| Vulnerable: |
Udo von Eynern Modern Guestbook / Commenting System 2.7.1 |
| Not Vulnerable: |
Udo von Eynern Modern Guestbook / Commenting System 2.7.2 |
Discussion
TYPO3 Modern Guestbook / Commenting System Extension Unspecified Cross Site Scripting Vulnerability
TYPO3 Modern Guestbook / Commenting System extension is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to Modern Guestbook / Commenting System 2.7.2 are vulnerable.
TYPO3 Modern Guestbook / Commenting System extension is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to Modern Guestbook / Commenting System 2.7.2 are vulnerable.
Exploit / POC
TYPO3 Modern Guestbook / Commenting System Extension Unspecified Cross Site Scripting Vulnerability
To exploit this issue, an attacker must entice a victim into following a malicious URI.
To exploit this issue, an attacker must entice a victim into following a malicious URI.
Solution / Fix
TYPO3 Modern Guestbook / Commenting System Extension Unspecified Cross Site Scripting Vulnerability
Solution:
Vendor fixes are available. Please see the references for details.
Solution:
Vendor fixes are available. Please see the references for details.
References
TYPO3 Modern Guestbook / Commenting System Extension Unspecified Cross Site Scripting Vulnerability
References:
References: