vendor:
Navboard
by:
SecurityFocus
7.5
CVSS
HIGH
Local File Inclusion and Cross-Site Scripting
94, 79
CWE
Product Name: Navboard
Affected Version From: Navboard 16
Affected Version To: Navboard 16
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Navboard Multiple Vulnerabilities
Navboard is prone to multiple local file-include vulnerabilities and a cross-site scripting vulnerability. An attacker can exploit the local file-include vulnerability using directory-traversal strings to execute local script code in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks. Exploits of the cross-site scripting issue may allow the attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Mitigation:
Ensure that all user-supplied input is validated and filtered before being used in the application. Ensure that all output is properly encoded before being returned to the user.
