Algis Info aiContactSafe Component for Joomla! 'url' Parameter Cross-Site Scripting Vulnerability

Bugtraq ID:	60261
Class:	Input Validation Error
CVE:	CVE-2013-3719
Remote:	Yes
Local:	No
Published:	Apr 16 2013 12:00AM
Updated:	Mar 19 2015 08:44AM
Credit:	Adam Willard
Vulnerable:	Algis Info aiContactSafe 2.0.14 Algis Info aiContactSafe 2.0.13
Not Vulnerable:

Algis Info aiContactSafe Component for Joomla! 'url' Parameter Cross-Site Scripting Vulnerability

The Algis Info aiContactSafe component for Joomla! is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

aiContactSafe versions 2.0.19 and prior are vulnerable.

Algis Info aiContactSafe Component for Joomla! 'url' Parameter Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Algis Info aiContactSafe Component for Joomla! 'url' Parameter Cross-Site Scripting Vulnerability

References:

• aiContactSafe Homepage (Algis Info)
  
• Joomla! Homepage (Joomla )
  
• XSS in aicontactsafe (Algis Info)
  
• [Foreground Security 2013-001]: Joomla AICONTACTSAFE 2.0.19 Extension Cross-Site (Foreground Security)