mcNews Script Injection Vulnerability

Bugtraq ID:	4773
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 17 2002 12:00AM
Updated:	May 17 2002 12:00AM
Credit:	Discovery of this issue is credited to frog frog <[email protected]>.
Vulnerable:	McNews McNews 1.2 McNews McNews 1.1 a McNews McNews 1.1 McNews McNews 1.0
Not Vulnerable:

mcNews Script Injection Vulnerability

mcNews is a set of scripts for allowing users to post news stories on a webpage. It will run on most Linux and Unix variants as well as Microsoft Windows operating systems.

mcNews does not sufficiently sanitize script code from form fields, making it prone to script injection attacks.

This may enable an attacker to hijack web content.

mcNews Script Injection Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

mcNews Script Injection Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

mcNews Script Injection Vulnerability

References:

• mcNews Homepage (mcNews)
  
• Security holes : mcNews (frog frog )