BID:8310

Roundup Client.PY HTML Injection Vulnerability

Info

Roundup Client.PY HTML Injection Vulnerability

Bugtraq ID:	8310
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 30 2003 12:00AM
Updated:	Jul 30 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Jeff Epler.
Vulnerable:	Roundup Roundup 0.5.7 Roundup Roundup 0.5.6 Roundup Roundup 0.5.5 Roundup Roundup 0.5.4 Roundup Roundup 0.5.3 Roundup Roundup 0.5.2 Roundup Roundup 0.5.1 Roundup Roundup 0.5

Not Vulnerable:	Roundup Roundup 0.5.9 Roundup Roundup 0.5.8 Stable

Discussion

Roundup Client.PY HTML Injection Vulnerability

Roundup is prone to an HTML injection vulnerability. An attacker may exploit this issue by including hostile HTML and script code in Roundup entries made through the Roundup web interface. This code may be rendered in the web browser of a user who later views these malicious entries. This would occur in the security context of the site hosting Roundup.

Exploit / POC

Roundup Client.PY HTML Injection Vulnerability

There is no exploit required.

Solution / Fix

Roundup Client.PY HTML Injection Vulnerability

Solution:
This issue has been resolved in Roundup version 0.5.8 Stable and higher.

Roundup Roundup 0.5