Family Connections 'subject' Parameter HTML Injection Vulnerability

Bugtraq ID:	47037
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 25 2011 12:00AM
Updated:	Mar 25 2011 12:00AM
Credit:	Zero Science Lab
Vulnerable:	Haudenschilt Family Connections 2.3.2
Not Vulnerable:

Family Connections 'subject' Parameter HTML Injection Vulnerability

Family Connections is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

Family Connections 2.3.2 is vulnerable; other versions may also be affected.

Family Connections 'subject' Parameter HTML Injection Vulnerability

An attacker can exploit this issue through a browser.

The following exploit code is available:

• /data/vulnerabilities/exploits/47037.txt

Family Connections 'subject' Parameter HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Family Connections 'subject' Parameter HTML Injection Vulnerability

References:

• Family Connections Homepage (Haudenschilt)