Secunia

Two vulnerabilities have been reported in SkunkWEB, which can be exploited by malicious people to conduct Cross-Site Scripting attacks and directory traversals.

An input validation error exists in "Handler.py" since the "404" error page includes the requested URL without prior sanitation. A malicious person can exploit this by constructing a link, which includes arbitrary script code. If a user is tricked into clicking the link or visit a malicious website, the script code will be executed in the user's browser session.

Successful exploitation may result in disclosure of various information (e.g. cookie-based authentication information) associated with the site running SkunkWEB, or inclusion of malicious content, which the user thinks is part of the real website.

An error furthermore exists in "Cache.py" making it possible to access resources outside the web root via a directory traversal attack.

Solution
Update to version 3.4b4:
Further details available in Customer Area

Provided and/or discovered by
Jeroen van Dongen

Changelog
Further details available in Customer Area

Original Advisory
http://sourceforge.net/project/shownotes.php?release_id=177513

Deep Links
Links available in Customer Area