Movable Type Comment Form HTML Code Injection Vulnerability

Bugtraq ID:	7560
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 12 2003 12:00AM
Updated:	May 12 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Dark Hunter <[email protected]>.
Vulnerable:	Movable Type Movable Type 2.0
Not Vulnerable:	Movable Type Movable Type 2.63

Movable Type Comment Form HTML Code Injection Vulnerability

A problem with the Movable Type Comment Form could allow remote users to execute arbitrary code in the context of the web site hosting Movable Type. The problem occurs due to the lack of sanitization performed on encoded character representations of HTML tags.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. Other attacks are also possible.

It should be noted that all Movable Type versions prior to version 2.6 have been confirmed vulnerable. The vendor has reported that this vulnerability has been addressed in versions higher than 2.6.

Movable Type Comment Form HTML Code Injection Vulnerability

There is no exploit required.

Movable Type Comment Form HTML Code Injection Vulnerability

Solution:
The vendor has reported that this issue has been addressed in the current version of Movable Type, users are advised to upgrade as soon as possible.


Movable Type Movable Type 2.0

• Movable Type Movable Type Version 2.63
  http://www.movabletype.org/download.shtml

Movable Type Comment Form HTML Code Injection Vulnerability

References:

• Movable Type Homepage (Movable Type)
  
• CSS found in Movable Type (DarkHunter )
  
• Re: CSS found in Movable Type (Jordan Wiens )
  
• Re: CSS found in Movable Type ()
  
• Re: CSS found in Movable Type (Jordan Wiens )