Squiz Matrix 'colour_picker.php' Cross Site Scripting Vulnerability

Bugtraq ID:	48118
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 06 2011 12:00AM
Updated:	Jun 06 2011 12:00AM
Credit:	Patrick Webster
Vulnerable:	Squiz Squiz Matrix 4.2.2 Squiz Squiz Matrix 4.0.6
Not Vulnerable:	Squiz Squiz Matrix 4.2.3 Squiz Squiz Matrix 4.0.7

Squiz Matrix 'colour_picker.php' Cross Site Scripting Vulnerability

Squiz Matrix is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Squiz Matrix 4.0.6 and 4.2.2 are vulnerable; other versions may also be affected.

Squiz Matrix 'colour_picker.php' Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

The following example URI is available:

http://www.example.com/__lib/html_form/colour_picker.php?colour=';%20alert(document.cookie);%20var%20x='&pickerid=000000

Squiz Matrix 'colour_picker.php' Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Squiz Matrix 'colour_picker.php' Cross Site Scripting Vulnerability

References:

• Squiz Matrix - Cross-Site Scripting Vulnerability (patrick)
  
• Squiz Matrix Homepage (squiz)
  
• Squiz Matrix - Cross-Site Scripting Vulnerability (Patrick Webster)