HTML Purifier CSS Quoting HTML Injection Vulnerability

Bugtraq ID:	44983
Class:	Input Validation Error
CVE:	CVE-2010-4183
Remote:	Yes
Local:	No
Published:	Sep 15 2010 12:00AM
Updated:	Sep 15 2010 12:00AM
Credit:	Mario Heiderich. and Takeshi Terada
Vulnerable:	Edward Z. Yang HTML Purifier 4.1.1 Edward Z. Yang HTML Purifier 4.1 Edward Z. Yang HTML Purifier 4.0 Edward Z. Yang HTML Purifier 3.1.1 Edward Z. Yang HTML Purifier 2.1.5 Edward Z. Yang HTML Purifier 2.0.1 Edward Z. Yang HTML Purifier 2.0 Edward Z. Yang HTML Purifier 3.1 Edward Z. Yang HTML Purifier 2.1
Not Vulnerable:	Edward Z. Yang HTML Purifier 4.2

HTML Purifier CSS Quoting HTML Injection Vulnerability

HTML Purifier is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Hostile HTML and script code may be injected into vulnerable sections of the application.

Versions prior to HTML Purifier 4.2.0 are vulnerable.

HTML Purifier CSS Quoting HTML Injection Vulnerability

Attackers can exploit this issue using a browser.

HTML Purifier CSS Quoting HTML Injection Vulnerability

References:

• Homepage (ABK Dating Software)
  
• HTML Purifier 4.2.0 released (Edward K. Zang)
  
• HTML Purifier Homepage (Edward Z. Yang)
  
• CSS Quoting Full Disclosure (HTML Purifier)