ht://Dig htsearch Cross Site Scripting Vulnerability
BID:5091
Info
ht://Dig htsearch Cross Site Scripting Vulnerability
| Bugtraq ID: | 5091 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 24 2002 12:00AM |
| Updated: | Jun 24 2002 12:00AM |
| Credit: | Credited to Howard Yeend <[email protected]>. |
| Vulnerable: |
The ht://Dig Group ht://Dig 3.2 0b3 The ht://Dig Group ht://Dig 3.2 .0 The ht://Dig Group ht://Dig 3.1.6 The ht://Dig Group ht://Dig 3.1.5 |
| Not Vulnerable: | |
Discussion
ht://Dig htsearch Cross Site Scripting Vulnerability
ht://Dig is a freely available, open source search engine. It is developed and maintained by the ht://Dig project, and functions on the Unix and Linux operating systems.
When a user submits a search request using ht://Dig, user supplied input is not sufficiently sanitized. Malicious URLs may cause arbitrary script code to be included in HTML generated by htsearch.cgi.
This could allow for the execution of malicious code in the context of the site.
ht://Dig is a freely available, open source search engine. It is developed and maintained by the ht://Dig project, and functions on the Unix and Linux operating systems.
When a user submits a search request using ht://Dig, user supplied input is not sufficiently sanitized. Malicious URLs may cause arbitrary script code to be included in HTML generated by htsearch.cgi.
This could allow for the execution of malicious code in the context of the site.
Exploit / POC
ht://Dig htsearch Cross Site Scripting Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
ht://Dig htsearch Cross Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.