DaCode News Message HTML Injection Vulnerability
BID:5798
Info
DaCode News Message HTML Injection Vulnerability
| Bugtraq ID: | 5798 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 25 2002 12:00AM |
| Updated: | Sep 25 2002 12:00AM |
| Credit: | Discovery of vulnerability credited to [email protected]. |
| Vulnerable: |
DaCode DaCode 1.2 .0 |
| Not Vulnerable: | |
Discussion
DaCode News Message HTML Injection Vulnerability
Problems with DaCode could make it possible to execute arbitrary script code in a vulnerable client.
DaCode does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the DaCode software.
Problems with DaCode could make it possible to execute arbitrary script code in a vulnerable client.
DaCode does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the DaCode software.
Exploit / POC
DaCode News Message HTML Injection Vulnerability
The following proof of concept was submitted.
<IMG SRC="javascript:alert('unsecure')">
The following proof of concept was submitted.
<IMG SRC="javascript:alert('unsecure')">
Solution / Fix
DaCode News Message HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.