Xoops Private Message System Font Attributes HTML Injection Vulnerability

Bugtraq ID:	6344
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 09 2002 12:00AM
Updated:	Dec 09 2002 12:00AM
Credit:	Discovery of this vulnerability credited to "fred magistrat" <[email protected]>.
Vulnerable:	Xoops Xoops 1.3.5
Not Vulnerable:	Xoops Xoops 1.3.6

Xoops Private Message System Font Attributes HTML Injection Vulnerability

Xoops includes a Private Message System for users, so that they may send messages to one another. HTML tags used for font attributes are not sufficiently filtered of malicious HTML code. This makes it possible for an attacker to supply malicious input in the HTML font tags that contain arbitrary script code. When another user receives the attacker's private message, the malicious script code will be executed on that user in the context of the site running Xoops.

Xoops Private Message System Font Attributes HTML Injection Vulnerability

The following proof of concepts were provided:

<b onMouseOver="alert(document.location);">test</b>
<i onClick="alert(document.location);">test</i>
<u onClick="alert('Hello');">test</u>

Xoops Private Message System Font Attributes HTML Injection Vulnerability

Solution:
The following fixes are available:


Xoops Xoops 1.3.5

• Xoops Xoops 1.3.5 Patch
  http://www.xoops.org/modules/mydownloads/singlefile.php?lid=265


• Xoops Xoops 1.3.6
  http://www.xoops.org/modules/mydownloads/viewcat.php?cid=16

Xoops Private Message System Font Attributes HTML Injection Vulnerability

References:

• ProManager Homepage (Promanager)