Info

Disclosure

Sep 30, 2003

Discovery

Unknown

Dates

Exploit

Sep 30, 2003

Solution

Unknown

Description

Geeklog Shoutbox Plugin contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate input upon submission to the Shoutbox script. This could allow a user to send a specially crafted request that would execute arbitrary code on the server leading to a loss of integrity. Note: The Shoutbox Plugin is not installed during a default Geeklog installation.

Classification

Location: Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Public
OSVDB: Web Related

Solution

Upgrade to version 1.3.8-1sr3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Falkware

Shoutbox for Geeklog

Unknown or Unspecified

References

ISS X-Force ID: 13323
Related OSVDB ID: 3272 3273
Bugtraq ID: 8718
Secunia Advisory ID: 9874
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2003-10/0071.html
Other Advisory URL: http://archives.neohapsis.com/archives/fulldisclosure/2003-q3/4901.html
Generic Informational URL: http://www.geeklog.net/article.php?story=2003092804362257
Vendor Specific Solution URL: http://www.geeklog.net/filemgmt/visit.php?lid=271
Vendor URL: http://www.geeklog.net/forum/viewtopic.php?showtopic=20524

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/2616