Pluck 'cont1' Parameter HTML Injection Vulnerability

Bugtraq ID:	43597
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 29 2010 12:00AM
Updated:	Sep 30 2010 09:10PM
Credit:	High-Tech Bridge SA
Vulnerable:	Pluck Pluck 4.6.3
Not Vulnerable:	Pluck Pluck 4.6.4

Pluck 'cont1' Parameter HTML Injection Vulnerability

Pluck is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Pluck 4.6.3 is vulnerable; other versions may also be affected.

Pluck 'cont1' Parameter HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example data is available:

• /data/vulnerabilities/exploits/43597.txt

Pluck 'cont1' Parameter HTML Injection Vulnerability

Solution:
Updates are available; please see the references for more information.

Pluck 'cont1' Parameter HTML Injection Vulnerability

References:

• HTB22610 (High-Tech Bridge)
  
• Pluck 4.6.4 maintenance release (Sander)
  
• Pluck Homepage (Pluck)
  
• XSS vulnerability in Pluck (Htbridge)