Info

Disclosure

Mar 29, 2006

Discovery

Mar 23, 2006

Dates

Exploit

Mar 29, 2006

Solution

Unknown

Description

@1 Table Publisher contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the Title of Table field upon submission to the tablepublisher.cgi script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: Customers can add in the "@1 Script Secure code" to help secure the code

Products

UPDI Network Enterprise

@1 Table Publisher

2006-03-23

References

Secunia Advisory ID: 19723
CVE ID: 2006-1795 (see also: NVD)
Other Advisory URL: http://osvdb.org/ref/24/24236-upoint.txt
Vendor URL: https://www.upoint.info/

Credit

security curmudgeon - jerichoattrition.org - attrition.org

Direct URL: http://osvdb.org/24238