MiniHTTPServer File-Sharing for NET Forum HTML Injection Vulnerability
BID:8781
Info
MiniHTTPServer File-Sharing for NET Forum HTML Injection Vulnerability
| Bugtraq ID: | 8781 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 06 2003 12:00AM |
| Updated: | Oct 06 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Nimber <[email protected]>. |
| Vulnerable: |
Minihttp File-Sharing for NET 1.5 |
| Not Vulnerable: | |
Discussion
MiniHTTPServer File-Sharing for NET Forum HTML Injection Vulnerability
File Sharing for NET has been reported prone to a HTML Injection Vulnerability. The issue has been reported to exist in the Forum that ships with the product. A malicious remote attacker may use forum post fields when creating a new forum post to inject arbitrary HTML into dynamically generated content. This issue is due to a lack of sufficient sanitization performed on the affected form fields.
An attacker may exploit this vulnerability to execute arbitrary HTML and script code in the browser of an unsuspecting user who views the malicious forum post. Code execution will occur in the context of the vulnerable site. This issue may be exploited to steal cookie based credentials other attacks may also be possible.
File Sharing for NET has been reported prone to a HTML Injection Vulnerability. The issue has been reported to exist in the Forum that ships with the product. A malicious remote attacker may use forum post fields when creating a new forum post to inject arbitrary HTML into dynamically generated content. This issue is due to a lack of sufficient sanitization performed on the affected form fields.
An attacker may exploit this vulnerability to execute arbitrary HTML and script code in the browser of an unsuspecting user who views the malicious forum post. Code execution will occur in the context of the vulnerable site. This issue may be exploited to steal cookie based credentials other attacks may also be possible.
Exploit / POC
MiniHTTPServer File-Sharing for NET Forum HTML Injection Vulnerability
This vulnerability may be exploited using a web browser.
This vulnerability may be exploited using a web browser.
Solution / Fix
MiniHTTPServer File-Sharing for NET Forum HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
MiniHTTPServer File-Sharing for NET Forum HTML Injection Vulnerability
References:
References:
- Mini HTTP Server Products Homepage (Mini HTTP Server)
- JS/HTML code injection in File-Sharing for NET v1.5 and Forums Web Server v1.5 (Nimber