Multiple Moo Products Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	42872
Class:	Input Validation Error
CVE:	CVE-2010-2364 CVE-2010-2365
Remote:	Yes
Local:	No
Published:	Aug 31 2010 12:00AM
Updated:	Aug 31 2010 12:00AM
Credit:	Yuji Tounai
Vulnerable:
Not Vulnerable:

Multiple Moo Products Unspecified Cross-Site Scripting Vulnerability

Multiple Moo products are prone to a cross-site scripting vulnerability because the applications fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The affected products are:

moobbs version 1.02 and prior are vulnerable.
moobbs2 version 1.02 and prior are vulnerable.

Multiple Moo Products Unspecified Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Multiple Moo Products Unspecified Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Multiple Moo Products Unspecified Cross-Site Scripting Vulnerability

References:

• JVNDB-2010-000033 (JVN)
  
• JVNDB-2010-000034 (JVN)
  
• Multiple Moo products cross-site scripting vulnerability (Moo)
  
• Product Homepage (Moo)