Booby Error Message Cross-Site Scripting Vulnerability
BID:8932
Info
Booby Error Message Cross-Site Scripting Vulnerability
| Bugtraq ID: | 8932 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 30 2003 12:00AM |
| Updated: | Oct 30 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Yao-Wen Huang. |
| Vulnerable: |
Booby Booby 0.2.3 Booby Booby 0.2.2 Booby Booby 0.2.1 Booby Booby 0.2 Booby Booby 0.1.3 Booby Booby 0.1.2 Booby Booby 0.1.1 Booby Booby 0.1 Booby Booby 0.0.3 Booby Booby 0.0.2 Booby Booby 0.0.1 |
| Not Vulnerable: |
Booby Booby 0.2.4 |
Discussion
Booby Error Message Cross-Site Scripting Vulnerability
It has been reported that a cross-site scripting vulnerability may exist in Booby that may allow remote attackers to execute HTML or script code in a user's browser. The issue is reported to occur due to error messages returned to the user. User-supplied data is not properly sanitized therefore allowing an attacker to a construct a malicious link containing HTML or script code that may be rendered in a user's browser.
Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.
Booby versions 0.2.3 and prior are reported to be prone to this issue.
It has been reported that a cross-site scripting vulnerability may exist in Booby that may allow remote attackers to execute HTML or script code in a user's browser. The issue is reported to occur due to error messages returned to the user. User-supplied data is not properly sanitized therefore allowing an attacker to a construct a malicious link containing HTML or script code that may be rendered in a user's browser.
Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.
Booby versions 0.2.3 and prior are reported to be prone to this issue.
Exploit / POC
Booby Error Message Cross-Site Scripting Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Booby Error Message Cross-Site Scripting Vulnerability
Solution:
The vendor has released version 0.2.4 to address this issue:
Booby Booby 0.0.1
Booby Booby 0.0.2
Booby Booby 0.0.3
Booby Booby 0.1
Booby Booby 0.1.1
Booby Booby 0.1.2
Booby Booby 0.1.3
Booby Booby 0.2
Booby Booby 0.2.1
Booby Booby 0.2.2
Booby Booby 0.2.3
Solution:
The vendor has released version 0.2.4 to address this issue:
Booby Booby 0.0.1
Booby Booby 0.0.2
Booby Booby 0.0.3
Booby Booby 0.1
Booby Booby 0.1.1
Booby Booby 0.1.2
Booby Booby 0.1.3
Booby Booby 0.2
Booby Booby 0.2.1
Booby Booby 0.2.2
Booby Booby 0.2.3