BN Soft BoastMachine Comment Form HTML Injection Vulnerability

Bugtraq ID:	9270
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 22 2003 12:00AM
Updated:	Dec 22 2003 12:00AM
Credit:	The disclosure of this issue has been credited to David Sopas Ferreira.
Vulnerable:	BN Soft BoastMachine 2.6
Not Vulnerable:

BN Soft BoastMachine Comment Form HTML Injection Vulnerability

It has been reported that BoastMachine may be prone to an HTML injection vulnerability that may allow a remote attacker to execute HTML and script code in a user's browser. The problem is reported to exist due to improper sanitizing of user-supplied data in the 'Comment' form.

This vulnerability has been reported to exist in BoastMachine version 2.6, however it is possible that other versions are affected as well.

BN Soft BoastMachine Comment Form HTML Injection Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

BN Soft BoastMachine Comment Form HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

BN Soft BoastMachine Comment Form HTML Injection Vulnerability

References:

• BoastMachine Product Page (BN Soft)