Zikula Application Framework CVE-2013-6168 'returnpage' Parameter Cross Site Scripting Vulnerability

Bugtraq ID:	63186
Class:	Input Validation Error
CVE:	CVE-2013-6168
Remote:	Yes
Local:	No
Published:	Oct 16 2013 12:00AM
Updated:	Mar 19 2015 08:32AM
Credit:	High-Tech Bridge Security Research Lab
Vulnerable:	Zikula Zikula Application Framework 1.3.5 build 20
Not Vulnerable:	Zikula Zikula Application Framework 1.3.6 build 19

Zikula Application Framework CVE-2013-6168 'returnpage' Parameter Cross Site Scripting Vulnerability

Zikula Application Framework is prone to an unspecified cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Zikula Application Framework 1.3.5 build 20 is vulnerable; prior versions may also be affected.

Zikula Application Framework CVE-2013-6168 'returnpage' Parameter Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Zikula Application Framework CVE-2013-6168 'returnpage' Parameter Cross Site Scripting Vulnerability

References:

• Cross-Site Scripting (XSS) in Zikula Application Framework (High-Tech Bridge information security solutions)
  
• QA testing for release of Core 1.3.6 build #19 (drak)
  
• Zikula Application Framework Homepage (Zikula)