Jetbox CMS Multiple Cross Site Scripting Vulnerabilities

TITLE: Jetbox CMS Multiple Cross Site Scripting Vulnerabilities
CLASS: Input Validation Error
CVE:
REMOTE: Yes
LOCAL: No
PUBLISHED: May 15 2007 12:00AM
UPDATE: May 16 2007 04:58PM
CREDIT: Mikhail Markin, Tomas Kuliavas and Michael Jordon are credited with the discovery of these vulnerabilities.
VULNERABLE:

Jetbox Jetbox CMS 2.1

NOT VULNERABLE:

Vai alla pagina originale su Security Focus

Discussion

Jetbox CMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

Jetbox CMS 2.1 is vulnerable.

Exploit

Attackers can use a browser to exploit these issues.

Example URIs have been provided:

• /data/vulnerabilities/exploits/23999.html

Solution

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:vuldb@securityfocus.com.

References

References:

• Jetbox CMS Homepage (Jetbox)
  
• Re: Jetbox CMS version 2.1 E-Mail Injection Vulnerability (laurent.gaffie@gmail.com)
  

PhpLog