|
 |
|
Gossamer Threads Links Script Insertion Vulnerabilities
|
|
|
|
|
Secunia Advisory:
|
SA15319
|
|
|
Release Date:
|
2005-07-06
|
|
Last Update:
|
2005-07-20
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Cross Site Scripting
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Gossamer Threads Links SQL 3.x
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Some vulnerabilities has been identified in Gossamer Threads Links, allowing malicious people to conduct script insertion attacks.
Input passed to the "Email" parameter in "user.cgi" and various parameters in "add.cgi" isn't properly sanitised before it is stored. This can be exploited to execute arbitrary code in the context of an administrative users browser session when reviewing users and links.
The vulnerability has been confirmed in version 3.01. Other versions may also be affected.
Solution:
Upgrade to version 3.04.
Provided and/or discovered by:
Secunia Research
Changelog:
2005-07-20: Added original advisory.
Original Advisory:
Secunia Research:
http://secunia.com/secunia_research/2005-26/advisory/
Gossamer Threads:
http://www.gossamer-threads.com/forum...sh_and_German_3.0.4_Released_P283710/
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
1 Related Secunia Security Advisories
|
|
|
1. Gossamer Threads Links Cross Site Scripting Vulnerability
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
