Info

Disclosure

Dec 27, 2004

Discovery

Dec 18, 2004

Dates

Exploit

Unknown

Solution

Unknown

Description

Limbo contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'searchword' variable upon submission to the 'index.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Unknown
OSVDB: Web Related

Solution

Upgrade to version 1.0.3 alpha or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Limbo

Limbo CMS

1.0.2

References

Related OSVDB ID: 12687
Secunia Advisory ID: 13596
Vendor URL: http://limbo.mamboforge.net/
Other Advisory URL: http://www.thebillygoatcurse.com/advisories/LimboXSS.pdf [ Link is 404 ]

Credit

Ryan McGeehan - ryanthebillygoatcurse.com -

Direct URL: http://osvdb.org/36218