Splatt Forum Image Tag HTML Injection Vulneraility
BID:4953
Info
Splatt Forum Image Tag HTML Injection Vulneraility
| Bugtraq ID: | 4953 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0959 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 06 2002 12:00AM |
| Updated: | Jul 11 2009 01:56PM |
| Credit: | Discovered by MegaHz <[email protected]>. |
| Vulnerable: |
Splatt Forum 3.0 |
| Not Vulnerable: |
Splatt Forum 3.1 |
Discussion
Splatt Forum Image Tag HTML Injection Vulneraility
Splatt Forum does not filter HTML from image tags. This may allow an attacker to inject arbitrary script code in forum messages. Injected script code will be executed in the browser of an arbitrary web user who views the malicious forum message, in the context of the website running Splatt Forum.
This may potentially be exploited to hijack web content or steal cookie-based authentication credentials from legitimate users.
Splatt Forum does not filter HTML from image tags. This may allow an attacker to inject arbitrary script code in forum messages. Injected script code will be executed in the browser of an arbitrary web user who views the malicious forum message, in the context of the website running Splatt Forum.
This may potentially be exploited to hijack web content or steal cookie-based authentication credentials from legitimate users.
Exploit / POC
Splatt Forum Image Tag HTML Injection Vulneraility
MegaHz <[email protected]> has provided the following example:
[img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img]
MegaHz <[email protected]> has provided the following example:
[img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img]
Solution / Fix
Splatt Forum Image Tag HTML Injection Vulneraility
Solution:
Reportedly this issue has been addressed in Splatt Forum 3.1. Currently only version 3.0 is available for download, administrators should frequently check the vendor site for the latest version.
Solution:
Reportedly this issue has been addressed in Splatt Forum 3.1. Currently only version 3.0 is available for download, administrators should frequently check the vendor site for the latest version.