Anthill Cross-Agent Scripting Vulnerability
BID:4442
Info
Anthill Cross-Agent Scripting Vulnerability
| Bugtraq ID: | 4442 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0549 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 06 2002 12:00AM |
| Updated: | Jul 11 2009 11:56AM |
| Credit: | Posted to BugTraq on April 6, 2002 by Ulf Harnhammar. |
| Vulnerable: |
Anthill Anthill 0.1.6 .1 |
| Not Vulnerable: | |
Discussion
Anthill Cross-Agent Scripting Vulnerability
Anthill is a PHP based bug tracking system.
Anthill version 0.1.6.1 (and prior) fails to sanitize user input, allowing HTML and script code to be entered by users into the bug tracking system. This code is then interpreted by other users' browsers when they view the affected pages.
Because AntHill uses cookies to authenticate users, this could be used by a malicious user to steal login information from other users.
Anthill is a PHP based bug tracking system.
Anthill version 0.1.6.1 (and prior) fails to sanitize user input, allowing HTML and script code to be entered by users into the bug tracking system. This code is then interpreted by other users' browsers when they view the affected pages.
Because AntHill uses cookies to authenticate users, this could be used by a malicious user to steal login information from other users.
Exploit / POC
Anthill Cross-Agent Scripting Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.