PHPWebSite News Message HTML Injection Vulnerability

Bugtraq ID:	5802
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 25 2002 12:00AM
Updated:	Sep 25 2002 12:00AM
Credit:	Discovery of this vulnerability credited to [email protected].
Vulnerable:	Appalachian State University phpWebSite 0.8.3
Not Vulnerable:

PHPWebSite News Message HTML Injection Vulnerability

Problems with phpWebSite could make it possible to execute arbitrary script code in a vulnerable client.

phpWebSite does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the phpWebSite software.

PHPWebSite News Message HTML Injection Vulnerability

The following proof of concept was submitted.

<IMG SRC="javascript:alert('unsecure')">

PHPWebSite News Message HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHPWebSite News Message HTML Injection Vulnerability

References:

• phpWebSite Homepage (Appalachian State University)