BID:7434

Xoops MyTextSanitizer HTML Injection Vulnerability

Info

Xoops MyTextSanitizer HTML Injection Vulnerability

Bugtraq ID:	7434
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 25 2003 12:00AM
Updated:	Apr 25 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to magistrat <[email protected]>.
Vulnerable:	Xoops Xoops 2.0.1 Xoops Xoops 2.0 Xoops Xoops 1.3.9 Xoops Xoops 1.3.8 Xoops Xoops 1.3.7 Xoops Xoops 1.3.6 Xoops Xoops 1.3.5

Not Vulnerable:	Xoops Xoops 2.0.2 Xoops Xoops 1.3.10

Discussion

Xoops MyTextSanitizer HTML Injection Vulnerability

A HTML injection vulnerability has been discovered in Xoops. The problem occurs due to insufficient filtering of HTML and script code by the MyTextSanitizer script.

Successful exploitation of this vulnerability may allow a malicious Xoops user to execute arbitrary HTML or script code within the browser of a legitimate user.

Exploit / POC

Xoops MyTextSanitizer HTML Injection Vulnerability

No exploit is required. However, the following proof of concept Javascript code has been made available:

java script:alert%28document.cookie%29

The script code must be embedded within HTML <img> tags.

Solution / Fix

Xoops MyTextSanitizer HTML Injection Vulnerability

Solution:
Xoops 1.3.10 and 2.0.2 have been released which address this issue. Users are advised to upgrade as soon as possible.

Xoops Xoops 1.3.5