Xoops MyLinks Myheader.php Cross-Site Scripting Vulnerability
BID:9269
Info
Xoops MyLinks Myheader.php Cross-Site Scripting Vulnerability
| Bugtraq ID: | 9269 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 21 2003 12:00AM |
| Updated: | Dec 21 2003 12:00AM |
| Credit: | Discovery is credited to Chintan Trivedi <[email protected]>. |
| Vulnerable: |
Xoops Xoops 2.0.5 .1 |
| Not Vulnerable: |
Xoops Xoops 2.0.5 .2 |
Discussion
Xoops MyLinks Myheader.php Cross-Site Scripting Vulnerability
Xoops is prone to a cross-site scripting vulnerability in the 'myheader.php' script included in the mylinks module. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. Exploitation could allow for theft of cookie-based authentication credentials or other attacks.
This issue was reported in Xoops 2.0.5.1. It is likely that other versions are also affected.
Xoops is prone to a cross-site scripting vulnerability in the 'myheader.php' script included in the mylinks module. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. Exploitation could allow for theft of cookie-based authentication credentials or other attacks.
This issue was reported in Xoops 2.0.5.1. It is likely that other versions are also affected.
Exploit / POC
Xoops MyLinks Myheader.php Cross-Site Scripting Vulnerability
The following examples were provided:
http://www.example.com/modules/mylinks/myheader.php?url=javascript:alert(document.cookie);
http://www.example.com/modules/mylinks/myheader.php?url="><script>alert(document.cookie)</script>
The following examples were provided:
http://www.example.com/modules/mylinks/myheader.php?url=javascript:alert(document.cookie);
http://www.example.com/modules/mylinks/myheader.php?url="><script>alert(document.cookie)</script>
Solution / Fix
Xoops MyLinks Myheader.php Cross-Site Scripting Vulnerability
Solution:
The vendor has released a fix to address this issue. Users are advised to upgrade to Xoops version 2.0.5.2.
Xoops Xoops 2.0.5 .1
Solution:
The vendor has released a fix to address this issue. Users are advised to upgrade to Xoops version 2.0.5.2.
Xoops Xoops 2.0.5 .1
-
Xoops xoops-2.0.5.1-to-2.0.5.2.patch.tar.gz
http://prdownloads.sourceforge.net/xoops/xoops-2.0.5.1-to-2.0.5.2.patc h.tar.gz?download
References
Xoops MyLinks Myheader.php Cross-Site Scripting Vulnerability
References:
References:
- ProManager Homepage (Promanager)
- XSS vulnerability in XOOPS 2.0.5.1 (Chintan Trivedi