Secunia Research: Pinnacle ShowCenter Skin File Cross-Site Scripting Vulnerability

====================================================================== 

                     Secunia Research 14/10/2004

 - Pinnacle ShowCenter Skin File Cross-Site Scripting Vulnerability -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

====================================================================== 
1) Affected Software 

Pinnacle ShowCenter 1.51 build 121.

NOTE: Other versions may also be affected.

====================================================================== 
2) Severity 

Rating: Less Critical 
Impact: Cross-Site Scripting
Where:  Remote

====================================================================== 
3) Vendor's Description of Software 

"ShowCenter lets you organize your personal and downloaded movies, 
music and photos on your PC, then enjoy them on your home 
entertainment center."
 
Product links:
http://www.pinnaclesys.com/ProductPage_n.asp?Product_ID=1481

====================================================================== 
4) Description of Vulnerability 

Secunia Research has discovered a vulnerability in Pinnacle 
ShowCenter, which can be exploited by malicious people to conduct 
cross-site scripting attacks.

Invalid input passed to the "Skin" parameter in "SettingsBase.php"
isn't sanitised before being returned to the user in a error page. 

This can be exploited to execute arbitrary HTML and script code in a 
user's browser session in context of an affected site by tricking the
user into visiting a malicious web site or follow a specially crafted
link.

Example:
http://[host]:8000/ShowCenter/SettingsBase.php?Skin=[code]

The vulnerability has been confirmed in version 1.51 build 121.
Other versions may also be affected.

====================================================================== 
5) Solution 

No vendor solution is currently available. The vendor has been
contacted multiple times, but has not responded.

Filter malicious characters and character sequences in a proxy or 
firewall with URL filtering capabilities.

====================================================================== 
6) Time Table 

22/09/2004 - Vulnerability discovered. 
28/09/2004 - Vendor notified.
04/10/2004 - Vendor notified (2nd time).
08/10/2004 - Vendor notified (3rd time).
14/10/2004 - Public disclosure.

====================================================================== 
7) Credits 

Discovered by Secunia Research.

====================================================================== 
8) References

The Common Vulnerabilities and Exposures (CVE) project has not
currently assigned the vulnerability a candidate number.

====================================================================== 
9) About Secunia 

Secunia collects, validates, assesses, and writes advisories regarding 
all the latest software vulnerabilities disclosed to the public. These 
advisories are gathered in a publicly available database at the 
Secunia website: 

http://secunia.com/

Secunia offers services to our customers enabling them to receive all 
relevant vulnerability information to their specific system 
configuration. 

Secunia offers a FREE mailing list called Secunia Security Advisories: 

http://secunia.com/secunia_security_advisories/

====================================================================== 
10) Verification 

Please verify this advisory by visiting the Secunia website: 
http://secunia.com/secunia_research/2004-9/

======================================================================