17 lines
No EOL
908 B
Text
Executable file
17 lines
No EOL
908 B
Text
Executable file
source: http://www.securityfocus.com/bid/37809/info
|
|
|
|
Zend Framework is prone to multiple input-validation vulnerabilities and a weakness:
|
|
|
|
- Multiple cross-site scripting issues
|
|
- An HTML-injection issue
|
|
- A security-bypass weakness
|
|
|
|
An attacker may leverage the cross-site scripting issues and HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
|
|
|
|
The attacker can exploit the security-bypass weakness in conjunction with other latent vulnerabilities to bypass certain security restrictions.
|
|
|
|
Versions prior to Zend Framework 1.7.9, 1.8.5, and 1.9.7 are vulnerable.
|
|
|
|
The following example URI is available:
|
|
|
|
http://www.example.com/index.php?lang=english&skin=&debut=0&seeAdd=1&seeNotes=&seeMess=[XSS-Vuln] |