Info

Disclosure

Feb 16, 2004

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

ASP Portal contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate "inc", "searchtext", and "article" variables upon submission to the index.asp script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Authentication Management, Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, ASP Portal has released a patch to address this vulnerability.

Products

ASPPortal.net

ASP Portal

Unknown or Unspecified

References

Secunia Advisory ID: 10879
Related OSVDB ID: 3966 3967
Vendor Specific Solution URL: http://www.aspportal.net/downloadsviewer.asp?theurl=38
Other Advisory URL: http://www.securitytracker.com/alerts/2004/Feb/1009050.html

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/36218