Vanilla Multiple HTML-Injection and Cross-Site Scripting Vulnerabilities

vendor:

Vanilla

by:

SecurityFocus

7.5

CVSS

HIGH

HTML-Injection and Cross-Site Scripting

79, 80

CWE

Product Name: Vanilla

Affected Version From: 1.1.2004

Affected Version To: 1.1.2004

Patch Exists: YES

Related CWE: N/A

CPE: Vanilla

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Vanilla Multiple HTML-Injection and Cross-Site Scripting Vulnerabilities

Vanilla is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to generate HTML output.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/30748/info

Vanilla is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

Vanilla 1.1.4 is vulnerable; other versions may also be affected. 

http://www.example.com/people.php?PostBackAction=Apply&NewPassword='"><script>alert document.cookie)%3B<%2Fscript>