MiniHTTPServer WebForums Forum HTML Injection Vulnerability
BID:8782
Info
MiniHTTPServer WebForums Forum HTML Injection Vulnerability
| Bugtraq ID: | 8782 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 06 2003 12:00AM |
| Updated: | Oct 06 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Nimber <[email protected]>. |
| Vulnerable: |
Minihttp WebForum Server 1.6 Minihttp WebForum Server 1.5 Minihttp WebForum Server 1.0 |
| Not Vulnerable: | |
Discussion
MiniHTTPServer WebForums Forum HTML Injection Vulnerability
MiniHTTPServer WebForums Forum has been reported prone to a HTML Injection Vulnerability. A malicious remote attacker may use forum post fields when creating a new forum post to inject arbitrary HTML into dynamically generated content. This issue is due to a lack of sufficient sanitization performed on the affected form fields.
An attacker may exploit this vulnerability to execute arbitrary HTML and script code in the browser of an unsuspecting user who views the malicious forum post. Code execution will occur in the context of the vulnerable site. This issue may be exploited to steal cookie based credentials other attacks may also be possible.
MiniHTTPServer WebForums Forum has been reported prone to a HTML Injection Vulnerability. A malicious remote attacker may use forum post fields when creating a new forum post to inject arbitrary HTML into dynamically generated content. This issue is due to a lack of sufficient sanitization performed on the affected form fields.
An attacker may exploit this vulnerability to execute arbitrary HTML and script code in the browser of an unsuspecting user who views the malicious forum post. Code execution will occur in the context of the vulnerable site. This issue may be exploited to steal cookie based credentials other attacks may also be possible.
Exploit / POC
MiniHTTPServer WebForums Forum HTML Injection Vulnerability
This vulnerability may be exploited using a web browser.
This vulnerability may be exploited using a web browser.
Solution / Fix
MiniHTTPServer WebForums Forum HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
MiniHTTPServer WebForums Forum HTML Injection Vulnerability
References:
References:
- Mini HTTP Server Products Homepage (Mini HTTP Server)
- JS/HTML code injection in File-Sharing for NET v1.5 and Forums Web Server v1.5 (Nimber