Land Down Under BBcode cross-site scripting
| landdownunder-bbcode-xss (16284) |  Medium Risk |
Description:
Land Down Under (LDU) is a content management system available for Web sites running on Microsoft Windows and Unix-based operating systems. Land Down Under versions prior to 700-06 are vulnerable to cross-site scripting, caused by improper filtering of user-supplied BBcode input. A remote attacker could embed malicious script in an image tag to a message on the forum using BBcode, which would be executed in the victim's Web browser within the security context of the hosting site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Platforms Affected:
- Neocrome, Land Down Under prior to 700-06
Remedy:
Upgrade to the latest version of Land Down Under (700-06 or later), available from the Land Down Under Web site. See References.
Consequences:
Obtain Information
References:
- BugTraq Mailing List, Sat May 29 2004 - 09:15:13 CDT, LDU (land down under) xss vulnerability at http://archives.neohapsis.com/archives/bugtraq/2004-05/0299.html.
- Land Down Under, Land Down Under Web site at http://ldu.neocrome.net/index.php.
- BID-10435: Land Down Under BBCode HTML Injection Vulnerability
- CVE-2004-2038: Cross-site scripting (XSS) vulnerability in Land Down Under (LDU) before LDU 700 allows remote attackers to inject arbitrary web script or HTML via a BBcode img tag in (1) functions.php, (2) header.php or (3) auth.inc.php.
- OSVDB ID: 6508: Land Down Under (LDU) BBCode IMG Tag XSS
- SA11739: Land Down Under BBcode Script Insertion Vulnerability
- SECTRACK ID: 1010335: Land Down Under Input Validation Hole in BBcodes Lets Remote Users Conduct Cross-Site Scripting Attacks
Reported:
May 29, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net