bugtraq - Cross-site scripting vulnerability in Crafy Syntax Live Help 2.7.3 and below

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 3 Jun 2004 17:52:16 +0000
From: "John C. Hennessy" <jchennessy@...ts.net>
To: bugtraq@...urityfocus.com
Cc: admin@...ts.net
Subject: Cross-site scripting vulnerability in Crafy Syntax Live Help 2.7.3 and below

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The problem:

Users are able to insert pieces of html both in
 their name when they request livehelp and in chat sessions.
For example. If I where to input the following  javascript inside a  
"<"script">" tag and use it as my name.

window.location("http://www.cgisecurity.com/articles/xss-faq.shtml");

This would cause all online operators to goto that
 URL. This on its own may not seem to be that big of a deal to you. The
 following example is a little more malicious. If the following snippet of
 code is put between script tags and then pasted into an chat session
 with an operator it will cause CSLH to remove the first operator.

window.location("http://livehelp.someisp.com/livehelp/operators.php?remove=1")

Solution:

Upgrade to CSLH 2.7.4.

HNK Technology Solutions would like to thank the developer(s) of CSLH for 
their quick response and fix for the problem.

John C. Hennessy
President/CTO
HNK Technology Solutions, Inc.
http://www.hnkts.net

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAv2VXT9ZtXavj78YRAiB9AJ9whkTWLcDsZW4BvAAherb+n8e8YQCgoIyB
+d78L6Bl/UoblPFmfOTXhXQ=
=oxIS
-----END PGP SIGNATURE-----