Info

Disclosure

Mar 27, 2006

Discovery

Mar 23, 2006

Dates

Exploit

Mar 27, 2006

Solution

Unknown

Description

@1 Event Publisher contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate Event, Description, Time, Website, and Public Remarks fields upon submission to the eventpublisher_admin.htm script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: Customers can add in the "@1 Script Secure code" to help secure the code

Products

UPDI Network Enterprise

@1 Event Publisher

2003-12-18

References

Secunia Advisory ID: 19727
CVE ID: 2006-1436 (see also: NVD)
Related OSVDB ID: 24236 24237
Other Advisory URL: http://osvdb.org/ref/24/24236-upoint.txt
Vendor URL: https://www.upoint.info/

Credit

security curmudgeon - jerichoattrition.org - attrition.org

Direct URL: http://osvdb.org/36218