PunBB 'linkedin' Parameter HTML Injection Vulnerability
BID:50944
Info
PunBB 'linkedin' Parameter HTML Injection Vulnerability
| Bugtraq ID: | 50944 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 07 2011 12:00AM |
| Updated: | Dec 07 2011 12:00AM |
| Credit: | mghack via Secunia |
| Vulnerable: |
PunBB PunBB 1.3.6 PunBB PunBB 1.3.5 PunBB PunBB 1.3.4 PunBB PunBB 1.3.3 PunBB PunBB 1.3.2 PunBB PunBB 1.3.1 PunBB PunBB 1.3 PunBB PunBB 1.4 |
| Not Vulnerable: |
PunBB PunBB 1.4.1 |
Discussion
PunBB 'linkedin' Parameter HTML Injection Vulnerability
PunBB is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible.
PunBB 1.4 and prior versions are vulnerable.
PunBB is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible.
PunBB 1.4 and prior versions are vulnerable.
Exploit / POC
PunBB 'linkedin' Parameter HTML Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
PunBB 'linkedin' Parameter HTML Injection Vulnerability
Solution:
Updates are available; please see the references for more information.
Solution:
Updates are available; please see the references for more information.
References
PunBB 'linkedin' Parameter HTML Injection Vulnerability
References:
References:
- PunBB 1.4.1 is released (PunBB)
- PunBB Homepage (PunBB)