Siteframe search.php Cross Site Scripting Vulnerability
BID:7140
Info
Siteframe search.php Cross Site Scripting Vulnerability
| Bugtraq ID: | 7140 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 19 2003 12:00AM |
| Updated: | Mar 19 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Ertan Kurt <[email protected]>. |
| Vulnerable: |
Siteframe Siteframe 2.2.4 |
| Not Vulnerable: | |
Discussion
Siteframe search.php Cross Site Scripting Vulnerability
It has been reported that Siteframe does not sufficiently filter user supplied URI parameters on Siteframe pages.
As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. All code will be executed within the context of the website running Siteframe.
This may allow for theft of cookie-based authentication credentials and other attacks.
This vulnerability was reported to affect Siteframe version 2.2.4, it is not currently known if other versions are affected.
It has been reported that Siteframe does not sufficiently filter user supplied URI parameters on Siteframe pages.
As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. All code will be executed within the context of the website running Siteframe.
This may allow for theft of cookie-based authentication credentials and other attacks.
This vulnerability was reported to affect Siteframe version 2.2.4, it is not currently known if other versions are affected.
Exploit / POC
Siteframe search.php Cross Site Scripting Vulnerability
The following proof of concept was provided:
http://www.example.com/search.php?searchfor="><script>alert('test');</script>
The following proof of concept was provided:
http://www.example.com/search.php?searchfor="><script>alert('test');</script>
Solution / Fix
Siteframe search.php Cross Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Siteframe search.php Cross Site Scripting Vulnerability
References:
References:
- Siteframe Homepage (Siteframe)
- Some XSS vulns (Ertan Kurt