PHPNuke Splatt Forum Module HTML Injection Vulnerability
BID:7484
Info
PHPNuke Splatt Forum Module HTML Injection Vulnerability
| Bugtraq ID: | 7484 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 01 2003 12:00AM |
| Updated: | May 01 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to morning_wood <[email protected]>. |
| Vulnerable: |
Splatt Forum 4.0 |
| Not Vulnerable: | |
Discussion
PHPNuke Splatt Forum Module HTML Injection Vulnerability
A problem with Splatt Forum could allow remote users to execute arbitrary code in the context of the web site running the Splatt Forum module. The problem occurs due to the lack of sanitization performed on character representations of HTML tags.
As a result, a malicious user may be able to submit a post to the vulnerable site containing embedded script code. This code would be executed by a user's browser in the context of the site.
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. The attacker may hijack the session of the legitimate by using cookie-based authentication credentials. Other attacks are also possible.
It should be noted that although this vulnerability has been reported to affect Splatt Forum version 4.0, previous versions may also be affected.
A problem with Splatt Forum could allow remote users to execute arbitrary code in the context of the web site running the Splatt Forum module. The problem occurs due to the lack of sanitization performed on character representations of HTML tags.
As a result, a malicious user may be able to submit a post to the vulnerable site containing embedded script code. This code would be executed by a user's browser in the context of the site.
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. The attacker may hijack the session of the legitimate by using cookie-based authentication credentials. Other attacks are also possible.
It should be noted that although this vulnerability has been reported to affect Splatt Forum version 4.0, previous versions may also be affected.
Exploit / POC
PHPNuke Splatt Forum Module HTML Injection Vulnerability
The following proof of concept has been supplied:
#
Typical text here <script>alert(document.cookie);</script> additional text here.
#
The following proof of concept has been supplied:
#
Typical text here <script>alert(document.cookie);</script> additional text here.
#
Solution / Fix
PHPNuke Splatt Forum Module HTML Injection Vulnerability
Solution:
The vendor has released a patch to address this issue. The effectiveness of this patch, however, has not been confirmed.
Splatt Forum 4.0
Solution:
The vendor has released a patch to address this issue. The effectiveness of this patch, however, has not been confirmed.
Splatt Forum 4.0
-
Splatt Splatt Forum 4.0 Fix 1
http://www.splatt.it/modules.php?name=Downloads&d_op=viewdownloaddetai ls&lid=166&ttitle=Splatt%20Forum%204.0%20Fix%201
References
PHPNuke Splatt Forum Module HTML Injection Vulnerability
References:
References:
- Splatt Homepage (Splatt)
- Multiple Vulnerabilities in Splatt Forum 4.0 (Frame4 Security Systems