ScozBook HTML Injection Vulnerability
BID:7235
Info
ScozBook HTML Injection Vulnerability
| Bugtraq ID: | 7235 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 29 2003 12:00AM |
| Updated: | Mar 29 2003 12:00AM |
| Credit: | Discovery of this vulnerability credited to "euronymous" <[email protected]>. |
| Vulnerable: |
ScozNet ScozBook 1.1 BETA |
| Not Vulnerable: | |
Discussion
ScozBook HTML Injection Vulnerability
ScozBook does not adequately filter some HTML code thus making it prone to HTML injection attacks.
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. The attacker may hijack the session of the legitimate by using cookie-based authentication credentials. Other attacks are also possible.
ScozBook does not adequately filter some HTML code thus making it prone to HTML injection attacks.
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. The attacker may hijack the session of the legitimate by using cookie-based authentication credentials. Other attacks are also possible.
Exploit / POC
ScozBook HTML Injection Vulnerability
There is no exploit code required.
There is no exploit code required.
Solution / Fix
ScozBook HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.