WebcamXP Message Field HTML Code Injection Vulnerability
BID:7490
Info
WebcamXP Message Field HTML Code Injection Vulnerability
| Bugtraq ID: | 7490 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 02 2003 12:00AM |
| Updated: | May 02 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to morning_wood <[email protected]> and Anthony Aykut <[email protected]>. |
| Vulnerable: |
Darkwet WebCam XP 1.2.535 Darkwet WebCam XP 1.2.432 |
| Not Vulnerable: | |
Discussion
WebcamXP Message Field HTML Code Injection Vulnerability
A problem with WebcamXP Chat page could allow remote users to execute arbitrary code in the context of the web site running WebcamXP Chat. The problem occurs due to the lack of sanitization performed on user-supplied input.
As a result, a malicious user may have the ability to submit a post to the site containing embedded HTML code. This code would be executed by a user's browser in the context of the vulnerable site.
It should be noted that although this vulnerability has been reported to affect WebcamXP version 1.02.432 and 1.02.535.4.0, previous versions might also be affected.
A problem with WebcamXP Chat page could allow remote users to execute arbitrary code in the context of the web site running WebcamXP Chat. The problem occurs due to the lack of sanitization performed on user-supplied input.
As a result, a malicious user may have the ability to submit a post to the site containing embedded HTML code. This code would be executed by a user's browser in the context of the vulnerable site.
It should be noted that although this vulnerability has been reported to affect WebcamXP version 1.02.432 and 1.02.535.4.0, previous versions might also be affected.
Exploit / POC
WebcamXP Message Field HTML Code Injection Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
WebcamXP Message Field HTML Code Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
WebcamXP Message Field HTML Code Injection Vulnerability
References:
References:
- WebCamXP Homepage (Darkwet)
- Code Injection Vulnerabilities in WebcamXP Chat Feature (Frame4 Security Systems