XOOPS HTML Injection and Cross Site Scripting Vulnerabilities
BID:49995
Info
XOOPS HTML Injection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 49995 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-4565 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 06 2011 12:00AM |
| Updated: | Dec 07 2011 06:27PM |
| Credit: | High-Tech Bridge SA |
| Vulnerable: |
Xoops Xoops 2.5.1 |
| Not Vulnerable: |
Xoops Xoops 2.5.2 |
Discussion
XOOPS HTML Injection and Cross Site Scripting Vulnerabilities
XOOPS is prone to HTML-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
XOOPS 2.5.1 is vulnerable; other versions may also be affected.
XOOPS is prone to HTML-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
XOOPS 2.5.1 is vulnerable; other versions may also be affected.
Exploit / POC
XOOPS HTML Injection and Cross Site Scripting Vulnerabilities
An attacker must trick an unsuspecting victim into following a malicious URI to exploit the cross-site scripting issue. An attacker can exploit the HTML-injection issue through a browser.
An attacker must trick an unsuspecting victim into following a malicious URI to exploit the cross-site scripting issue. An attacker can exploit the HTML-injection issue through a browser.
Solution / Fix
XOOPS HTML Injection and Cross Site Scripting Vulnerabilities
Solution:
Vendor updates are available. Please see the reference for more details.
Solution:
Vendor updates are available. Please see the reference for more details.
References
XOOPS HTML Injection and Cross Site Scripting Vulnerabilities
References:
References:
- XOOPS 2.5.3 Final Released (XOOPS)
- XOOPS Homepage (XOOPS)
- Multiple XSS in XOOPS Web Application Platform (High-Tech Bridge SA)