header-logo
Suggest Exploit
vendor:
DaCode
by:
SecurityFocus
7.5
CVSS
HIGH
DaCode HTML Injection
79
CWE
Product Name: DaCode
Affected Version From: DaCode 1.0
Affected Version To: DaCode 1.0
Patch Exists: YES
Related CWE: CVE-2002-1490
CPE: o:dacode:dacode_1.0
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2002

Problems with DaCode

DaCode is vulnerable to HTML injection attacks due to insufficient filtering of potentially malicious HTML code from news posts. When a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user.

Mitigation:

DaCode should filter potentially malicious HTML code from news posts.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5798/info

Problems with DaCode could make it possible to execute arbitrary script code in a vulnerable client.

DaCode does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the DaCode software. 

<IMG SRC="javascript:alert('unsecure')">

Navigation

Suggest Exploit

Services By CQR