Sosci Survey Multiple Security Vulnerabilities

Bugtraq ID:	59278
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Apr 17 2013 12:00AM
Updated:	Apr 17 2013 12:00AM
Credit:	T. Lazauninkas and V. Paulikas
Vulnerable:	SoSci Survey SoSci Survey 2.3.04
Not Vulnerable:	SoSci Survey SoSci Survey 2.3.04a

Sosci Survey Multiple Security Vulnerabilities

Sosci Survey is prone to following security vulnerabilities:

1. An unauthorized-access vulnerability
2. Multiple cross-site scripting vulnerabilities
3. Multiple HTML-injection vulnerabilities
4. A PHP code-execution vulnerability

Successful exploits may allow an attacker to gain unauthorized access to the affected application, allow attacker-supplied HTML and script code to run in the context of the affected browser, allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or inject and execute arbitrary malicious PHP code in the context of the web server process.

Sosci Survey Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Sosci Survey Multiple Security Vulnerabilities

References:

• �?nderungen in oFb Version 2.3.05 (SoSci Survey)
  
• SEC Consult 20130417-0 :: Multiple vulnerabilities in Sosci Survey (Fulldisclosure)
  
• SoSci Survey HomePage (SoSci Survey)