header-logo
Suggest Exploit
vendor:
NPDS
by:
SecurityFocus
8.8
CVSS
HIGH
Cross-Site Scripting
79
CWE
Product Name: NPDS
Affected Version From: NPDS 5.0
Affected Version To: NPDS 5.0
Patch Exists: YES
Related CWE: CVE-2002-0991
CPE: a:npds:npds
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2002

Problems with NPDS

NPDS does not sufficiently filter potentially malicious HTML code from news posts, allowing an attacker to inject malicious JavaScript code into a news post. When a user views the post, the code is executed in the browser of the vulnerable user in the context of the site running the NPDS software.

Mitigation:

Ensure that all user-supplied input is properly sanitized and filtered before being used in the application.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5797/info

Problems with NPDS could make it possible to execute arbitrary script code in a vulnerable client.

NPDS does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the NPDS software.

<IMG SRC="javascript:alert('unsecure')">

Navigation

Suggest Exploit

Services By CQR