Input-validation vulnerabilities and weakness in Zend Framework

vendor:

Zend Framework

by:

Unknown

N/A

CVSS

N/A

Cross-Site Scripting (XSS), HTML Injection, Security Bypass

Unknown

CWE

Product Name: Zend Framework

Affected Version From: Prior to Zend Framework 1.7.9, 1.8.5, and 1.9.7

Affected Version To: Unknown

Patch Exists: YES

Related CWE: Unknown

CPE: Unknown

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Input-validation vulnerabilities and weakness in Zend Framework

Attackers can exploit cross-site scripting and HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user. This can lead to the theft of authentication credentials and other attacks. Additionally, the security-bypass weakness can be leveraged to bypass certain security restrictions.

Mitigation:

Upgrade to Zend Framework versions 1.7.9, 1.8.5, or 1.9.7 or later.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/37809/info

Zend Framework is prone to multiple input-validation vulnerabilities and a weakness:

- Multiple cross-site scripting issues
- An HTML-injection issue
- A security-bypass weakness

An attacker may leverage the cross-site scripting issues and HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The attacker can exploit the security-bypass weakness in conjunction with other latent vulnerabilities to bypass certain security restrictions.

Versions prior to Zend Framework 1.7.9, 1.8.5, and 1.9.7 are vulnerable. 

The following example URI is available:

http://www.example.com/index.php?lang=english&skin=&debut=0&seeAdd=1&seeNotes=&seeMess=[XSS-Vuln]