BID:5135

Betsie Parserl.PL Cross-Site Scripting Vulnerability

Info

Betsie Parserl.PL Cross-Site Scripting Vulnerability

Bugtraq ID:	5135
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 01 2002 12:00AM
Updated:	Jul 01 2002 12:00AM
Credit:	Discovery of this issue is credited to Mark Rowe <[email protected]>.
Vulnerable:	BBC Education Betsie 1.5.11 BBC Education Betsie 1.5.10 BBC Education Betsie 1.5.9 BBC Education Betsie 1.5.8 BBC Education Betsie 1.5.7 BBC Education Betsie 1.5.6 BBC Education Betsie 1.5.5 BBC Education Betsie 1.5.4 BBC Education Betsie 1.5.3 BBC Education Betsie 1.5.2 BBC Education Betsie 1.5.1 BBC Education Betsie 1.5

Not Vulnerable:	BBC Education Betsie 1.5.12

Discussion

Betsie Parserl.PL Cross-Site Scripting Vulnerability

Betsie (BBC Education Text to Speech Internet Enhancer) is prone to a cross-site scripting vulnerability. This issue exists in the parserl.pl script.

Attackers may exploit this condition via a malicious link to a site running the vulnerable software. Successful exploitation will enable an attacker to cause script code to be executed in the web browser of a user who visits the malicious link.

Exploit / POC

Betsie Parserl.PL Cross-Site Scripting Vulnerability

The following example was provided to reproduce this condition:

http://server/cgi-bin/betsie/parserl.pl/<script>alert("eek!")</script>