Faq-O-Matic 2.6/2.7 - Cross-Site Scripting Vulnerability

ID EDB-ID:21263
Type exploitdb
Reporter superpetz
Modified 2002-02-04T00:00:00


Faq-O-Matic 2.6/2.7 Cross-Site Scripting Vulnerability. CVE-2002-0230. Remote exploit for cgi platform

                                            source: http://www.securityfocus.com/bid/4023/info

FAQ-O-Matic is a freely available, open-source FAQ (Frequently Asked Questions) manager. It is intended to run on Linux and Unix variants.

FAQ-O-Matic does not sufficiently filter script code from URL parameters. It is possible to create a malicious link containing arbitrary script code. When a legitimate user browses the malicious link, the script code will be executed in the user's browser in the context of the website running Faq-O-Matic.

As a result, it may be possible for a remote attacker to steal cookie-based authentication credentials from a legitimate user of the service.