Chamilo Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Bugtraq ID:	58735
Class:	Input Validation Error
CVE:	CVE-2013-0738 CVE-2013-0739
Remote:	Yes
Local:	No
Published:	Mar 27 2013 12:00AM
Updated:	Mar 27 2013 12:00AM
Credit:	Fernando Muñoz via Secunia.
Vulnerable:
Not Vulnerable:

Chamilo Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Chamilo is prone to an HTML-injection vulnerability, multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Chamilo 1.9.4 is vulnerable; other versions may also be affected.

Chamilo Multiple Cross Site Scripting and HTML Injection Vulnerabilities

An attacker can exploit these issues through a browser. To exploit the cross-site scripting issue, the attacker must entice an unsuspecting victim into following a malicious URI.

Chamilo Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Chamilo Multiple Cross Site Scripting and HTML Injection Vulnerabilities

References:

• Chamilo Homepage (Chamilo)