Elgg 'params[twitter_username]' Parameter HTML Injection Vulnerability

Bugtraq ID:	57569
Class:	Input Validation Error
CVE:	CVE-2013-0234
Remote:	Yes
Local:	No
Published:	Jan 28 2013 12:00AM
Updated:	Jan 29 2013 10:40AM
Credit:	Reported by the vendor
Vulnerable:	Curverider Elgg 1.8.5 Curverider Elgg 1.8.4 Curverider Elgg 1.7.14 Curverider Elgg 1.7.13 Curverider Elgg 1.7.11 Curverider Elgg 1.7.10
Not Vulnerable:

Elgg 'params[twitter_username]' Parameter HTML Injection Vulnerability

Elgg is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Elgg 1.7.16 and 1.8.12 are vulnerable; prior versions may also be affected.

Elgg 'params[twitter_username]' Parameter HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Elgg 'params[twitter_username]' Parameter HTML Injection Vulnerability

Solution:
Reports indicate that the updated versions will be released on 29th January 2013 . Please contact the vendor for more information.

Elgg 'params[twitter_username]' Parameter HTML Injection Vulnerability

References:

• Elgg Homepage (Curverider)