Double Choco Latte HTML Injection Vulnerability

Bugtraq ID:	5182
Class:	Input Validation Error
CVE:	CVE-2002-1037
Remote:	Yes
Local:	No
Published:	Jul 07 2002 12:00AM
Updated:	Jul 11 2009 02:56PM
Credit:	Published in a Double Choco Latte changelog.
Vulnerable:	Double Choco Latte Double Choco Latte 20020215 Double Choco Latte Double Choco Latte 20020120
Not Vulnerable:	Double Choco Latte Double Choco Latte 20020706

Double Choco Latte HTML Injection Vulnerability

Double Choco Latte (DCL) is a bug tracking system which allow a users to track changes, requests, call center activity etc. DCL is maintained by Michael Dean.

HTML tags are not properly filtered from DCL HTML generated pages. This may enable a remote attacker to inject arbitrary HTML, including script code, into HTML pages. The script code will execute in the web browser of a user viewing the page.

This issue exists in versions of DCL prior to 20020706.

Double Choco Latte HTML Injection Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Double Choco Latte HTML Injection Vulnerability

References:

• Double Choco Latte Homepage (Michael Dean)