Multiple MT312 Applications Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	44367
Class:	Input Validation Error
CVE:	CVE-2009-1880 CVE-2009-1881
Remote:	Yes
Local:	No
Published:	May 29 2009 12:00AM
Updated:	May 29 2009 12:00AM
Credit:	Masako Oono
Vulnerable:	MT312 REP-BBS 0 MT312 IMG-BBS 0
Not Vulnerable:

Multiple MT312 Applications Unspecified Cross Site Scripting Vulnerability

Multiple MT312 applications are prone to an unspecified cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

The following products are vulnerable:

IMG-BBS
REP-BBS

Multiple MT312 Applications Unspecified Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Multiple MT312 Applications Unspecified Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Multiple MT312 Applications Unspecified Cross Site Scripting Vulnerability

References:

• JVN#01115659 REP-BBS from MT312 vulnerable to cross-site scripting (JVN)
  
• JVN#70836284 IMG-BBS from MT312 vulnerable to cross-site scripting (JVN)
  
• JVNDB-2009-000033 REP-BBS from MT312 vulnerable to cross-site scripting (JVN)
  
• JVNDB-2009-000034 IMG-BBS from MT312 vulnerable to cross-site scripting (JVN)
  
• MT312 Homepage (MT312)