easyXDM CVE-2013-5212 Multiple HTML Injection Vulnerabilities
BID:63318
Info
easyXDM CVE-2013-5212 Multiple HTML Injection Vulnerabilities
| Bugtraq ID: | 63318 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-5212 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 23 2013 12:00AM |
| Updated: | Oct 23 2013 12:00AM |
| Credit: | Krzysztof Kotowicz |
| Vulnerable: |
easyXDM easyXDM 2.4.16 |
| Not Vulnerable: |
easyXDM easyXDM 2.4.18 |
Discussion
easyXDM CVE-2013-5212 Multiple HTML Injection Vulnerabilities
easyXDM is prone to multiple HTML-injection vulnerabilities because it fails to sanitize user-supplied input.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
easyXDM 2.4.16 is vulnerable; other versions may also be affected.
easyXDM is prone to multiple HTML-injection vulnerabilities because it fails to sanitize user-supplied input.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
easyXDM 2.4.16 is vulnerable; other versions may also be affected.
Exploit / POC
easyXDM CVE-2013-5212 Multiple HTML Injection Vulnerabilities
An attacker can exploit these issues using a browser.
The following proof of concept is available:
An attacker can exploit these issues using a browser.
The following proof of concept is available:
Solution / Fix
easyXDM CVE-2013-5212 Multiple HTML Injection Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.