Microsoft SharePoint Server HTML-injection Vulnerability

vendor:

SharePoint Server

by:

SecurityFocus

3.3

CVSS

MEDIUM

HTML-injection

CWE

Product Name: SharePoint Server

Affected Version From: Microsoft SharePoint Server 2.0

Affected Version To: Microsoft SharePoint Server 2.0

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Microsoft SharePoint Server HTML-injection Vulnerability

Microsoft SharePoint Server is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting this issue may allow the attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to dynamically generate HTML content.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/28706/info

Microsoft SharePoint Server is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data. Note that to perform attacks, an attacker requires access to a user account with sufficient privileges to edit pages.

Exploiting this issue may allow the attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Microsoft SharePoint Server 2.0 is vulnerable; other versions may also be affected.

"""></P></div></td><script>[your javascript here]</script>