Bitfolge Snif Index.PHP Path Cross-Site Scripting Vulnerability

Bugtraq ID:	9179
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 09 2003 12:00AM
Updated:	Dec 09 2003 12:00AM
Credit:	Discovery of this issue is credited Justin Hagstrom.
Vulnerable:	Bitfolge snif 1.2.6
Not Vulnerable:

Bitfolge Snif Index.PHP Path Cross-Site Scripting Vulnerability

Bitfolge Snif is prone to a cross-site scripting vulnerability. As a result, hostile HTML and script code may be embedded in a malicious link to a site hosting the vulnerable software. If such a link is visited by a victim user, the attacker-supplied code may render in their web browser in the context of the site.

This issue was reported in version 1.2.6. Other versions are also likely affected.

Bitfolge Snif Index.PHP Path Cross-Site Scripting Vulnerability

The following example was provided:

http://www.example.com/index.php?path=<script>alert(document.domain)</script>

Bitfolge Snif Index.PHP Path Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Bitfolge Snif Index.PHP Path Cross-Site Scripting Vulnerability

References:

• Snif Homepage (Bitfolge)