[SA12613] Pinnacle ShowCenter Skin File Cross-Site Scripting Vulnerability

2004-10-16T00:00:00
ID SECURITYVULNS:DOC:7018
Type securityvulns
Reporter Securityvulns
Modified 2004-10-16T00:00:00

Description

TITLE: Pinnacle ShowCenter Skin File Cross-Site Scripting Vulnerability

SECUNIA ADVISORY ID: SA12613

VERIFY ADVISORY: http://secunia.com/advisories/12613/

CRITICAL: Less critical

IMPACT: Cross Site Scripting

WHERE: >From remote

SOFTWARE: Pinnacle ShowCenter 1.x http://secunia.com/product/3938/

DESCRIPTION: Secunia Research has discovered a vulnerability in Pinnacle ShowCenter, which can be exploited by malicious people to conduct cross-site scripting attacks.

Invalid input passed to the "Skin" parameter in "SettingsBase.php" isn't sanitised before being returned to the user in a error page. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site by tricking the user into visiting a malicious web site or follow a specially crafted link.

Example: http://[host]:8000/ShowCenter/SettingsBase.php?Skin=[code]

The vulnerability has been confirmed in version 1.51 build 121. Other versions may also be affected.

SOLUTION: No vendor solution is currently available. The vendor has been contacted multiple times, but has not responded.

Filter malicious characters and character sequences in a proxy or firewall with URL filtering capabilities.

PROVIDED AND/OR DISCOVERED BY: Secunia Research


About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.