e107 Website System 0.50.6 - Log.php HTML Injection

2004-05-21T00:00:00
ID EXPLOITPACK:30E6A6344BDE307C33CCAA0918F3FD14
Type exploitpack
Reporter Chinchilla
Modified 2004-05-21T00:00:00

Description

e107 Website System 0.50.6 - Log.php HTML Injection

                                        
                                            source: https://www.securityfocus.com/bid/10395/info

It is reported that e107 website system is prone to a remote HTML injection vulnerability. This issue is due to a failure by the application to properly sanitize user-supplied input.

The problem presents itself when a user supplies malicious HTML or script code to the application using a URI parameter of the log.php script. The application stores the injected HTML code, which is then rendered in the browser of an unsuspecting user whenever the log page of the affected site is viewed.

http://www.example.com/e107_plugins/log/log.php?referer=code<br>goes<here>&color=24&eself=http://www.example.com/stats.php&res=1341X1341