Synthetic Reality SymPoll Cross-Site Scripting Vulnerability
BID:8956
Info
Synthetic Reality SymPoll Cross-Site Scripting Vulnerability
| Bugtraq ID: | 8956 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 03 2003 12:00AM |
| Updated: | Nov 03 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Michael Frame <[email protected]>. |
| Vulnerable: |
Synthetic Reality Sympoll 1.5 |
| Not Vulnerable: | |
Discussion
Synthetic Reality SymPoll Cross-Site Scripting Vulnerability
It has been reported that Sympoll is prone to a cross-site scripting vulnerability. The issue is reported to exist due insufficient sanitization of user-supplied data through the 'vo' parameter. The problem may allow a remote attacker to execute HTML or script code in the browser of a user following a malicious link created by an attacker.
Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.
Sympoll version 1.5 is reported to be prone to this issue, however other versions may be affected as well.
It has been reported that Sympoll is prone to a cross-site scripting vulnerability. The issue is reported to exist due insufficient sanitization of user-supplied data through the 'vo' parameter. The problem may allow a remote attacker to execute HTML or script code in the browser of a user following a malicious link created by an attacker.
Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.
Sympoll version 1.5 is reported to be prone to this issue, however other versions may be affected as well.
Exploit / POC
Synthetic Reality SymPoll Cross-Site Scripting Vulnerability
The following proof of concept has been provided:
http://www.example.com/index.php?vo="><script>alert(document.cookie);</script>
The following proof of concept has been provided:
http://www.example.com/index.php?vo="><script>alert(document.cookie);</script>
Solution / Fix
Synthetic Reality SymPoll Cross-Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.