Mldonkey Web Interface Error Message Cross-site Scripting Vulnerability

Bugtraq ID:	8946
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 31 2003 12:00AM
Updated:	Oct 31 2003 12:00AM
Credit:	This vulnerability was reported by Chris Sharp <[email protected]>.
Vulnerable:	Mldonkey Mldonkey 2.5 -4
Not Vulnerable:

Mldonkey Web Interface Error Message Cross-site Scripting Vulnerability

It has been reported that the Mldonkey web interface is prone to cross-site scripting attacks when reporting errors. The problem occurs due to insufficient sanitization of script code within requests. This could potentially allow an attacker to carry out a variety of attacks on a user.

Mldonkey Web Interface Error Message Cross-site Scripting Vulnerability

No exploit required. The following proof of concept URL has been provided.

http://127.0.0.1:4080/<script>...</script>

Mldonkey Web Interface Error Message Cross-site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Mldonkey Web Interface Error Message Cross-site Scripting Vulnerability

References:

• MLDonkey Homepage (MLDonkey)