Decoda Cross Site Scripting Vulnerability

Bugtraq ID:	53332
Class:	Input Validation Error
CVE:	CVE-2012-3830
Remote:	Yes
Local:	No
Published:	May 02 2012 12:00AM
Updated:	Mar 19 2015 07:35AM
Credit:	RedTeam Pentesting GmbH
Vulnerable:	Decoda Decoda 3.3.2
Not Vulnerable:	Decoda Decoda 3.3.3

Decoda Cross Site Scripting Vulnerability

Decoda is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Decoda 3.3.3 are vulnerable.

Decoda Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to visit a malicious site. Please see the references for more information.

The following proof-of-concept exploit is available:

• /data/vulnerabilities/exploits/53332.txt

Decoda Cross Site Scripting Vulnerability

Solution:
Reportedly the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.

Decoda Cross Site Scripting Vulnerability

References:

• milesjohnson Decoda Home page (milesjohnson)
  
• milesjohnson decoda RedTeam advisory page (milesjohnson)
  
• milesjohnson decoda tags (milesjohnson )