Offiria 'index.php' prameter Cross Site Scripting Vulnerability

Bugtraq ID:	66657
Class:	Input Validation Error
CVE:	CVE-2014-2689
Remote:	Yes
Local:	No
Published:	Apr 02 2014 12:00AM
Updated:	May 08 2014 12:40AM
Credit:	High-Tech Bridge
Vulnerable:
Not Vulnerable:

Offiria 'index.php' prameter Cross Site Scripting Vulnerability

Offiria is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input before being returned to the user.

An attacker may leverage this issue to execute arbitrary script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Offiria 2.1.0 are vulnerable.

Offiria 'index.php' prameter Cross Site Scripting Vulnerability

To exploit this issue an attacker must entice an unsuspecting user to follow a malicious URI.

The following example URI is available:

http://example.com/installer/index.php/[XSS]

Offiria 'index.php' prameter Cross Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Offiria 'index.php' prameter Cross Site Scripting Vulnerability

References: