Info

Disclosure

Sep 30, 2008

Discovery

Unknown

Dates

Exploit

Sep 30, 2008

Solution

Unknown

Description

Celoxis contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'ni.smessage' parameters upon submission to the 'user.do' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
OSVDB: Web Related

Solution

Products

Unknown or Incomplete

References

CVE ID: 2008-6094 (see also: NVD)
Bugtraq ID: 31514
Secunia Advisory ID: 32081
Mail List Post: http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/064814.html

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/48687