Slashcode Paragraph Tag Script Injection Vulnerability
BID:5140
Info
Slashcode Paragraph Tag Script Injection Vulnerability
| Bugtraq ID: | 5140 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 02 2002 12:00AM |
| Updated: | Jul 02 2002 12:00AM |
| Credit: | Discovery credited to gcsb <[email protected]>. |
| Vulnerable: |
Slashcode Slashcode 2.2 |
| Not Vulnerable: |
Slashcode Slashcode 2.2.5 Slashcode Slashcode 2.2.4 Slashcode Slashcode 2.2.3 Slashcode Slashcode 2.2.2 Slashcode Slashcode 2.2.1 |
Discussion
Slashcode Paragraph Tag Script Injection Vulnerability
SlashCode is a bulletin board, discussion and portal framework. It is widely used, and is behind the popular Slashdot page.
Reportedly, a script injection vulnerability exists in some CVS versions of SlashCode. It may be possible for a malicious user of the system to inject arbitrary HTML code into content generated by the SlashCode system. Supplied script code may access authentication credentials, or take actions as an authenticated user.
** It has been reported that this issue only exists in CVS versions of SlashCode from between June 17 and July 1 2002.
SlashCode is a bulletin board, discussion and portal framework. It is widely used, and is behind the popular Slashdot page.
Reportedly, a script injection vulnerability exists in some CVS versions of SlashCode. It may be possible for a malicious user of the system to inject arbitrary HTML code into content generated by the SlashCode system. Supplied script code may access authentication credentials, or take actions as an authenticated user.
** It has been reported that this issue only exists in CVS versions of SlashCode from between June 17 and July 1 2002.
Exploit / POC
Slashcode Paragraph Tag Script Injection Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Slashcode Paragraph Tag Script Injection Vulnerability
Solution:
Users of versioned releases of SlashCode, including 2.2.5, are not vulnerable to this issue.
This issue only exists in CVS versions of SlashCode from between June 17 and July 1 2002. Users who updated their CVS tree during these times are strongly advised to run cvs update.
Development code from CVS has fixes for the vulnerability as of 02 July 2002. Users of CVS versions of SlashCode are urged to run cvs update and install the most recent code.
Solution:
Users of versioned releases of SlashCode, including 2.2.5, are not vulnerable to this issue.
This issue only exists in CVS versions of SlashCode from between June 17 and July 1 2002. Users who updated their CVS tree during these times are strongly advised to run cvs update.
Development code from CVS has fixes for the vulnerability as of 02 July 2002. Users of CVS versions of SlashCode are urged to run cvs update and install the most recent code.
References
Slashcode Paragraph Tag Script Injection Vulnerability
References:
References:
- CVS Vulnerability (SlashCode)
- Slashcode Homepage (Slashcode)