SIPS Themes Form Manipulation Vulnerability

Bugtraq ID:	4097
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 11 2002 12:00AM
Updated:	Feb 11 2002 12:00AM
Credit:	This vulnerability was submitted to BugTraq on February 11th, 2002 by "b0iler _" <[email protected]>.
Vulnerable:	SIPS SIPS 0.3 pl2 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17 SIPS SIPS 0.3 pl1 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17 SIPS SIPS 0.3 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17 SIPS SIPS 0.2.4 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17
Not Vulnerable:	SIPS SIPS 0.3.1 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17

SIPS Themes Form Manipulation Vulnerability

This issue may be exploited with a web browser and a text editor.

SIPS Themes Form Manipulation Vulnerability

Solution:
The vendor has addressed this issue in SIPS v0.3.1. Affected users are advised to upgrade.


SIPS SIPS 0.2.4

• SIPS sips-0.3.1.tar.gz
  http://prdownloads.sourceforge.net/sips/sips-0.3.1.tar.gz

SIPS SIPS 0.3 pl2

• SIPS sips-0.3.1.tar.gz
  http://prdownloads.sourceforge.net/sips/sips-0.3.1.tar.gz

SIPS SIPS 0.3

• SIPS sips-0.3.1.tar.gz
  http://prdownloads.sourceforge.net/sips/sips-0.3.1.tar.gz

SIPS SIPS 0.3 pl1

• SIPS sips-0.3.1.tar.gz
  http://prdownloads.sourceforge.net/sips/sips-0.3.1.tar.gz

SIPS Themes Form Manipulation Vulnerability

References:

• Administrator vulnerability in SIPS (Haakon Nilsen)
  
• SIPS Project Page (SIPS)