High-Tech Bridge SA has discovered some vulnerabilities in Habari, which can be exploited by malicious people to conduct cross-site scripting attacks.

1) Input passed to the "additem_form" parameter in system/admin/dash_additem.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

2) Input passed to the "status_data[]" parameter in system/admin/dash_status.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

Successful exploitation of the vulnerabilities requires that "register_globals" is enabled.

The vulnerabilities are confirmed in version 0.6.5. Prior versions may also be affected.

Solution
Update to version 0.6.6.

Provided and/or discovered by
High-Tech Bridge SA

Changelog
Further details available to Secunia VIM customers

Original Advisory
Habari:
http://wiki.habariproject.org/en/Release_0.6.6

High-Tech Bridge SA (HTB22731, HTB22733):
http://www.htbridge.ch/advisory/xss_vulnerability_in_habari.html
http://www.htbridge.ch/advisory/xss_vulnerability_in_habari_1.html

Deep Links
Links available to Secunia VIM customers