IU BLog Comment Form HTML Code Injection Vulnerability
BID:7553
Info
IU BLog Comment Form HTML Code Injection Vulnerability
| Bugtraq ID: | 7553 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 12 2003 12:00AM |
| Updated: | May 12 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Dark Hunter <[email protected]>. |
| Vulnerable: |
IU Blog IU Blog |
| Not Vulnerable: | |
Discussion
IU BLog Comment Form HTML Code Injection Vulnerability
A problem with IU BLog Comment Form could allow remote users to execute arbitrary code in the context of the web site hosting IU BLog. The problem occurs due to the lack of sanitization performed on encoded character representations of HTML tags.
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. Other attacks are also possible.
A problem with IU BLog Comment Form could allow remote users to execute arbitrary code in the context of the web site hosting IU BLog. The problem occurs due to the lack of sanitization performed on encoded character representations of HTML tags.
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. Other attacks are also possible.
Exploit / POC
IU BLog Comment Form HTML Code Injection Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
IU BLog Comment Form HTML Code Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
IU BLog Comment Form HTML Code Injection Vulnerability
References:
References: