Nuked-Klan Shoutbox HTML Injection Vulnerability

Bugtraq ID:	6700
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 27 2003 12:00AM
Updated:	Jan 27 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to Grégory Le Bras <gregory.lebras@security- corp.org>.
Vulnerable:	Nuked-Klan Nuked-Klan 1.2 beta
Not Vulnerable:	Nuked-Klan Nuked-Klan 1.3 beta

Nuked-Klan Shoutbox HTML Injection Vulnerability

A vulnerability has been discovered in the Nuked-Klan 'Shoutbox' module. It has been reported that Nuked-Klan fails to sufficiently sanitize script code embedded in certain user-supplied variables.

As a result, attackers may embed malicious script code or HTML into shoutbox messages. When a malicious message is viewed by another user, the attacker-supplied code will be interpreted in their web browser in the security context of the site hosting the software.

Nuked-Klan Shoutbox HTML Injection Vulnerability

There is no exploit required.

Nuked-Klan Shoutbox HTML Injection Vulnerability

Solution:
The vendor has released a patch which addresses this issue.


Nuked-Klan Nuked-Klan 1.2 beta

• Nuked-Klan Shoutbox_13.zip
  http://www.nuked-klan.org/files/Shoutbox_13.zip

Nuked-Klan Shoutbox HTML Injection Vulnerability

References:

• [SCSA-003] Multiple Cross Site Scripting & Script Injection Vulnerabilities in N (Grégory Le Bras )