eTransfer Lite HTML-injection Vulnerability

vendor:

eTransfer Lite

by:

SecurityFocus

7,5

CVSS

HIGH

HTML-injection

CWE

Product Name: eTransfer Lite

Affected Version From: eTransfer Lite 1.0

Affected Version To: eTransfer Lite 1.0

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

eTransfer Lite HTML-injection Vulnerability

eTransfer Lite is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to generate HTML output.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/62313/info

eTransfer Lite is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

eTransfer Lite 1.0 is vulnerable; other versions may also be affected. 

<bq>The following files are hosted live from the iPad's Docs folder.</bq><p><b>Images:<br><br></b>
<a href="http://www.example.com/%3C[PERSISTENT INJECTED SCRIPT CODE!]%3Es2.png"><[PERSISTENT INJECTED SCRIPT 
CODE!]">s2.png</a>
(    51.8 Kb, 2013-08-25 02:09:25 +0000)<br />
<a href="a2b642e7de.jpg">a2b642e7de.jpg</a>
(   238.0 Kb, 2013-08-25 02:08:13 +0000)<br />
</p><br><br><br><hr><br><br><br><center><form
 action="" method="post" enctype="multipart/form-data" name="form1" 
id="form1"><label>Upload file to iPad  <input type="file" 
name="file" id="file" /></label><label> <input 
type="submit" name="button" id="button" value="Submit" 
/></label></form></center><br><br><br>Powered
 By <a 
href=http://www.example.com</a></body></html></iframe></a></p></body></html>