Nuked-Klan Guestbook HTML Injection Vulnerability
BID:6697
Info
Nuked-Klan Guestbook HTML Injection Vulnerability
| Bugtraq ID: | 6697 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 27 2003 12:00AM |
| Updated: | Jan 27 2003 12:00AM |
| Credit: | The discovery of this vulnerability has been credited to Grégory Le Bras <[email protected]>. |
| Vulnerable: |
Nuked-Klan Nuked-Klan 1.2 beta |
| Not Vulnerable: |
Nuked-Klan Nuked-Klan 1.3 beta |
Discussion
Nuked-Klan Guestbook HTML Injection Vulnerability
A vulnerability has been discovered in the Nuked-Klan guestbook module. It has been reported that Nuked-Klan fails to sufficiently sanitize script code embedded in certain user-supplied variables.
As a result, attackers may embed malicious script code or HTML into forum posts. When a malicious post is viewed by another user, the attacker-supplied code will be interpreted in their web browser in the security context of the site hosting the software.
A vulnerability has been discovered in the Nuked-Klan guestbook module. It has been reported that Nuked-Klan fails to sufficiently sanitize script code embedded in certain user-supplied variables.
As a result, attackers may embed malicious script code or HTML into forum posts. When a malicious post is viewed by another user, the attacker-supplied code will be interpreted in their web browser in the security context of the site hosting the software.
Exploit / POC
Nuked-Klan Guestbook HTML Injection Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
Nuked-Klan Guestbook HTML Injection Vulnerability
Solution:
A patch has been released which addresses this issue.
Nuked-Klan Nuked-Klan 1.2 beta
Solution:
A patch has been released which addresses this issue.
Nuked-Klan Nuked-Klan 1.2 beta
-
tomysnockers.net Guestbook.rar
http://tomysnockers.net/download/Guestbook.rar
References
Nuked-Klan Guestbook HTML Injection Vulnerability
References:
References: