Anfibia Reactor 'email' Parameter HTML Injection Vulnerability

Bugtraq ID:	47200
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 06 2011 12:00AM
Updated:	Apr 06 2011 12:00AM
Credit:	Gjoko Krstic
Vulnerable:	Anfibia Software Anfibia Reactor 2.1.1.12
Not Vulnerable:	Anfibia Software Anfibia Reactor 3

Anfibia Reactor 'email' Parameter HTML Injection Vulnerability

Anfibia Reactor is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

Anfibia Reactor 2.1.1.12 is vulnerable; other versions may also be affected.

Anfibia Reactor 'email' Parameter HTML Injection Vulnerability

An attacker can exploit this issue through a browser.

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/47200.txt

Anfibia Reactor 'email' Parameter HTML Injection Vulnerability

Solution:
The vendor has released updates. Please contact the vendor for details.

Anfibia Reactor 'email' Parameter HTML Injection Vulnerability

References:

• Anfibia Reactor Homepage (Anfibia Software)
  
• Anfibia Reactor 2.1.1 (login.do) Remote XSS POST Injection Vulnerability (Zero Science Lab)