4images Cross Site Request Forgery and Cross Site Scripting Vulnerabilities

Bugtraq ID:	44544
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 29 2010 12:00AM
Updated:	Oct 29 2010 12:00AM
Credit:	Secunia Research Russ McRee
Vulnerable:	4homepages 4images 1.7.8 4homepages 4images 1.7.7 4homepages 4images 1.7.6 4homepages 4images 1.7.5 4homepages 4images 1.7.4 4homepages 4images 1.7.3 4homepages 4images 1.7.1 4homepages 4images 1.7
Not Vulnerable:

4images Cross Site Request Forgery and Cross Site Scripting Vulnerabilities

4images is prone to multiple cross-site scripting vulnerabilities and a cross-site request-forgery vulnerability.

An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, and disclose or modify sensitive information. Other attacks may also be possible.

4images 1.7.8 is vulnerable; other versions may also be affected.

4images Cross Site Request Forgery and Cross Site Scripting Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI or visiting a malicious website.

4images Cross Site Request Forgery and Cross Site Scripting Vulnerabilities

Solution:
The vendor has released fixes. Please see the references for details.

4images Cross Site Request Forgery and Cross Site Scripting Vulnerabilities

References:

• 4images (4images)
  
• 4images (4images)
  
• 4images Homepage (4homepages)
  
• 4images Cross-Site Scripting Vulnerability (Secunia Research)