Michael Schatz Books PostNuke Module Cross Site Scripting Vulnerability

Bugtraq ID:	5882
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 03 2002 12:00AM
Updated:	Oct 03 2002 12:00AM
Credit:	Discovery of this vulnerability credited to Pistone <[email protected]>.
Vulnerable:	Michael Schatz Books 0.54 Michael Schatz Books 0.6
Not Vulnerable:

Michael Schatz Books PostNuke Module Cross Site Scripting Vulnerability

Books is a module written for PostNuke. Reportedly, Books is prone to cross site scripting attacks.

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link containing HTML and script code. The attacker-supplied HTML and script code may be executed on a web client in the context of the site hosting the vulnerable module.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

Michael Schatz Books PostNuke Module Cross Site Scripting Vulnerability

The following proof of concept was provided:

http://servernuke/modules.php?op=modload&name=books&file=index&req=search&query=
<script>alert(document.cookie)</script>

Michael Schatz Books PostNuke Module Cross Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Michael Schatz Books PostNuke Module Cross Site Scripting Vulnerability

References:

• BOOKS module (Michael Schatz)