Wordl Recipe 2.11 Cross Site Scripting

`Armorize Technologies Security Advisory (Armorize-ADV-2008-0001)  
  
Title: Multiple XSS Vulnerabilities in World Recipe 2.11  
  
Date: 2008/12/15  
  
Status: Full  
  
Class: Input Validation Error  
  
Bugtraq ID: N/A  
  
Category: Cross Site Scripting  
  
Language: ASP.NET (C#)  
  
Description Armorize-ADV-2008-0001 discloses multiple cross-site scripting vulnerabilities that are found in World Recipe, which is an ASP.NET 2.0 C# application and SQL Database with stored procedure to contain and display recipes in a wide variety of categories.  
  
Discussion World Recipe is vulnerable to cross-site scripting attack because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to make targeted users executing arbitrary scripts in the context of the affected website. As a result, the attacker may be able to steal authentication credentials such as cookie, to alter the integrity of the visited page, and to launch other attacks such as phishing and force redirect.  
  
  
Exploit:  
  
http://www.example.com/[PATH]/emailrecipe.aspx  
GET variables "n" is vulnerable.  
  
http://www.example.com/[PATH]/recipedetail.aspx  
GET variable "id" is vulnerable.  
  
http://www.example.com/[PATH]/validatefieldlength.aspx  
GET variable "catid" is vulnerable.  
  
  
Vulnerable  
Vendor: Ex-designz (http://www.ex-designz.net/)  
Software: World Recipe  
Version: 2.11  
URL: http://www.ex-designz.net/softwaredetail.asp?fid=1884  
  
  
Suggested Solution:  
1. Constrain all input.  
2. Reject all prohibited input.  
3. Escape every input.  
  
Disclosure Timeline:  
2008/12/12 Vendor notification  
2008/12/15 Full disclosure at SecurityFocus mailing list  
  
Credit: Armorize Security Taskforce (ASF) at Armorize Technologies, Inc. (security dot armorize dot com)  
Armorize Technologies is a software security company focusing on Web application security. The award-winning automated source code analysis solution, CodeSecure, provides the simplest and most accurate solution for identifying the root causes of vulnerabilities directly in the Web application source code and for enforcing Secure Software Development Lifecycle (Secure SDLC) effectively and efficiently. Find out more at Armorize Technologies website, http://www.armorize.com.  
`