Snitz Forums Search.ASP Cross-Site Scripting Vulnerability
BID:7922
Info
Snitz Forums Search.ASP Cross-Site Scripting Vulnerability
| Bugtraq ID: | 7922 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0492 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 16 2003 12:00AM |
| Updated: | Jul 11 2009 10:06PM |
| Credit: | Discovery of this vulnerability has been credited to JeiAr <[email protected]>. |
| Vulnerable: |
Snitz Forums 2000 Snitz Forums 2000 3.4 .03 |
| Not Vulnerable: | |
Discussion
Snitz Forums Search.ASP Cross-Site Scripting Vulnerability
Snitz Forums is prone to cross-site scripting attacks. This is due to insufficient sanitization of data passed to the search facility via URI parameters.
Exploitation may allow theft of cookie-based authentication credentials or other attacks.
This issue was reported in Snitz Forums 3.4.0.3, other versions might also be affected.
Snitz Forums is prone to cross-site scripting attacks. This is due to insufficient sanitization of data passed to the search facility via URI parameters.
Exploitation may allow theft of cookie-based authentication credentials or other attacks.
This issue was reported in Snitz Forums 3.4.0.3, other versions might also be affected.
Exploit / POC
Snitz Forums Search.ASP Cross-Site Scripting Vulnerability
The following proof of concept has been provided:
http://www.example.com/search.asp?Search=">&lt;script&gt;alert()&lt;/script&gt;
The following proof of concept has been provided:
http://www.example.com/search.asp?Search=">&lt;script&gt;alert()&lt;/script&gt;
Solution / Fix
Snitz Forums Search.ASP Cross-Site Scripting Vulnerability
Solution:
The vendor has supplied the following patch which addresses this issue:
Replace the first line, located approximately on line #640, with the second line.
First:
" <td bgColor=""" & strPopUpTableColor & """ align=""left"" valign=""middle""><input type=""text"" name=""Search"" size=""40"" value=""" & Request.QueryString("Search") & """><br />" & vbNewLine & _
Second:
" <td bgColor=""" & strPopUpTableColor & """ align=""left"" valign=""middle""><input type=""text"" name=""Search"" size=""40"" value=""" & ChkString(Request.QueryString("Search"),"display") & """><br />" & vbNewLine & _
Solution:
The vendor has supplied the following patch which addresses this issue:
Replace the first line, located approximately on line #640, with the second line.
First:
" <td bgColor=""" & strPopUpTableColor & """ align=""left"" valign=""middle""><input type=""text"" name=""Search"" size=""40"" value=""" & Request.QueryString("Search") & """><br />" & vbNewLine & _
Second:
" <td bgColor=""" & strPopUpTableColor & """ align=""left"" valign=""middle""><input type=""text"" name=""Search"" size=""40"" value=""" & ChkString(Request.QueryString("Search"),"display") & """><br />" & vbNewLine & _