Sympoll index.php XSS

2003-11-10T04:36:38
ID OSVDB:2790
Type osvdb
Reporter OSVDB
Modified 2003-11-10T04:36:38

Description

Vulnerability Description

Ralusp Sympoll 1.5 contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not verify the "vo" parameter in "index.php". This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Solution Description

As of December 2003, there are no known upgrades, patches, or workarounds available to correct this issue. When available, patches and updates, may be found at the Sympoll Web site.

Short Description

Ralusp Sympoll 1.5 contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not verify the "vo" parameter in "index.php". This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

References:

Secunia Advisory ID:10165 ISS X-Force ID: 13630 Generic Informational URL: http://sourceforge.net/tracker/index.php?func=detail&aid=834374&group_id=64442&atid=507493 Bugtraq ID: 8956