Jcow Social Networking Script 'g' Parameter Cross Site Scripting Vulnerability

Bugtraq ID:	49325
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 26 2011 12:00AM
Updated:	Aug 26 2011 12:00AM
Credit:	Aung Khant, YGN Ethical Hacker Group.
Vulnerable:	Jcow Jcow 4.3 Jcow Jcow 4.2.1
Not Vulnerable:	Jcow Jcow 4.3.1

Jcow Social Networking Script 'g' Parameter Cross Site Scripting Vulnerability

Jcow is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Jcow 4.3.1 are vulnerable.

Jcow Social Networking Script 'g' Parameter Cross Site Scripting Vulnerability

To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting victim to follow a malicious URI.

• /data/vulnerabilities/exploits/49325.txt

Jcow Social Networking Script 'g' Parameter Cross Site Scripting Vulnerability

Solution:
Updates are available. Please contact the vendor for more information.

Jcow Social Networking Script 'g' Parameter Cross Site Scripting Vulnerability

References:

• Jcow CMS 4.2 <= | Cross Site Scripting (Jcow)
  
• Jcow Homepage (Jcow)