Thread-IT Message Field Input Validation Flaws Permit Remote Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1007803
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 24 2003
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via local system, Modification of user information
|
Exploit Included: Yes
|
Description: A vulnerability was reported in Thread-IT Message Board. A remote user can conduct cross-site scripting attacks.
It is reported that the software does not filter HTML from the user-supplied Topic Title, Name and Message fields. A remote user
can submit a specially crafted message that, when viewed by a target user, will cause arbitrary scripting code to be executed by
the target user's browser. The code will originate from the site running the Thread-IT software and will run in the security context
of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any,
associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site
acting as the target user.
The vendor has reportedly been notified.
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
Thread-IT software, access data recently submitted by the target user via web form to the site, or take actions on the site acting
as the target user.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.ymonda.co.uk/ProductDetails.aspx?productID=411&selection=6 (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Windows (Any)
|
Reported By: Bahaa Naamneh <b_naamneh@hotmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: 24 Sep 2003 20:45:29 -0000
From: Bahaa Naamneh <b_naamneh@hotmail.com>
Subject: Thread-IT Message Board XSS Vulnerability
|
Thread-IT Message Board XSS Vulnerability
Published: 24 September 2003
Released: 24 September 2003
Affected Systems: Thread-IT Message Board
Vendor: http://www.ymonda.co.uk
Issue: Remote attackers can inject XSS script.
Description:
============
"Thread-IT is a simple message board product that uses classic ASP scripts and an Access databas
e. Installation of this product is
simple even for people that have no ASP scripting experience."
Details:
========
It's possibile to inject XSS script in the Topic Title, Name and Message fields.
Examples:
"><script> this code will hide every thing after it including the the board top
ics if any attacker write it in the topic title.
<script>windows.open("URL");</script> this code will open a new
window when the board loaded.
Solution:
=========
The vendor has been contacted and a patch is not yet produced.
Suggestions:
============
Filter all variables.
Discovered by / credit:
=======================
Bahaa Naamneh
b_naamneh@hotmail.com
http://www.bsecurity.tk
|
|
