Recipe Script Multiple Input Validation Vulnerabilities

Bugtraq ID:	37359
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 16 2009 12:00AM
Updated:	Dec 17 2009 08:23PM
Credit:	Milos Zivanovic
Vulnerable:	Wright Way Services Recipe Script 5
Not Vulnerable:

Recipe Script Multiple Input Validation Vulnerabilities

Recipe Script is prone to multiple vulnerabilities, including cross-site scripting issues, HTML-injection issues, a mail-relay issue, and an arbitrary-file-upload issue.

Attackers can leverage these issues to run arbitrary HTML or script code in the context of the affected site or access certain administrative functions, steal cookie-based authentication credentials, control how the site is rendered to the user, cause a denial of service, and compromise the application. Other attacks are also possible.

Recipe Script 5.0 is vulnerable; other versions may also be affected.

Recipe Script Multiple Input Validation Vulnerabilities

Attackers can exploit these issues via a browser. To exploit a cross-site scripting issue, an attacker must entice an unsuspecting user to follow a specially crafted URI.

The following example data and URIs are available:

• /data/vulnerabilities/exploits/37359.txt

Recipe Script Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Recipe Script Multiple Input Validation Vulnerabilities

References:

• Recipe Script Homepage (Wright Way Services)