Webfroot Shoutbox Viewshoutbox.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	9289
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 23 2003 12:00AM
Updated:	Dec 23 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Ben Drysdale <[email protected]>.
Vulnerable:	Webfroot Shoutbox 2.32
Not Vulnerable:

Webfroot Shoutbox Viewshoutbox.PHP Cross-Site Scripting Vulnerability

Webfroot Shoutbox is prone to a cross-site scripting vulnerability in the 'viewshoutbox.php' script. The source of the problem is that HTML and script code are not adequately sanitized from input supplied via URI parameters. This input will be included in dynamically generated web pages. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. The attacker-supplied code will be interpreted in the context of the site hosting the vulnerable software.

Webfroot Shoutbox Viewshoutbox.PHP Cross-Site Scripting Vulnerability

The following proof of concept has been supplied:

http://www.example.com/shoutbox/viewshoutbox.php?error="><script>alert(document.cookie);</script>

Webfroot Shoutbox Viewshoutbox.PHP Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Webfroot Shoutbox Viewshoutbox.PHP Cross-Site Scripting Vulnerability

References:

• Shoutbox (Webfroot)