ProjectForum HTML Injection Vulnerability
BID:9272
Info
ProjectForum HTML Injection Vulnerability
| Bugtraq ID: | 9272 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 22 2003 12:00AM |
| Updated: | Dec 22 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Peter Winter-Smith <[email protected]>. |
| Vulnerable: |
CourseForum Technologies ProjectForum 8.4.2 .1 |
| Not Vulnerable: | |
Discussion
ProjectForum HTML Injection Vulnerability
It has been reported that ProjectForum may be prone to an HTML injection vulnerability that may allow a remote attacker to execute HTML and script code in a user's browser. The problem is reported to exist due to improper sanitizing of user-supplied data in the administrator login page, the find function, and the error page.
ProjectForum versions 8.4.2.1 and prior have been reported to be prone to this issue.
It has also been reported that CourseForum, a similar application which uses the
same engine as ProjectForum, is also vulnerable to these attacks. Specific versions of the software have not been identified therefore this BID will be updated as more information becomes available.
It has been reported that ProjectForum may be prone to an HTML injection vulnerability that may allow a remote attacker to execute HTML and script code in a user's browser. The problem is reported to exist due to improper sanitizing of user-supplied data in the administrator login page, the find function, and the error page.
ProjectForum versions 8.4.2.1 and prior have been reported to be prone to this issue.
It has also been reported that CourseForum, a similar application which uses the
same engine as ProjectForum, is also vulnerable to these attacks. Specific versions of the software have not been identified therefore this BID will be updated as more information becomes available.
Exploit / POC
ProjectForum HTML Injection Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
ProjectForum HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
ProjectForum HTML Injection Vulnerability
References:
References:
- ProjectForum Product Page (CourseForum Technologies)
- ProjectForum Multiple Vulnerabilities ("Peter Winter-Smith"