Kusaba X Report Function HTML Injection Vulnerability
BID:38351
Info
Kusaba X Report Function HTML Injection Vulnerability
| Bugtraq ID: | 38351 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 18 2010 12:00AM |
| Updated: | Feb 18 2010 12:00AM |
| Credit: | [email protected] |
| Vulnerable: |
Kusaba X Kusaba X 0.9 |
| Not Vulnerable: |
Kusaba X Kusaba X 0.9.1 |
Discussion
Kusaba X Report Function HTML Injection Vulnerability
Kusaba X is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Kusaba X 0.9 is vulnerable; prior versions may also be affected.
Kusaba X is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Kusaba X 0.9 is vulnerable; prior versions may also be affected.
Exploit / POC
Kusaba X Report Function HTML Injection Vulnerability
Attackers can exploit this issue with a browser.
Attackers can exploit this issue with a browser.
Solution / Fix
Kusaba X Report Function HTML Injection Vulnerability
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Solution:
The vendor has released an advisory and updates. Please see the references for details.
References
Kusaba X Report Function HTML Injection Vulnerability
References:
References:
- Kusaba X 0.9.1 Released! (Sazpaimon)
- Vendor Homepage (Kusaba X )
- Kusaba X <= 0.9 XSS/CSRF vulnerabilities ([email protected])