phpMoneyBooks 'index.php' Multiple HTML Injection Vulnerabilities

http://www.securityfocus.com/bid/54247

Security Info

Bugtraq ID:	54247
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 29 2012 12:00AM
Updated:	Jun 29 2012 12:00AM
Credit:	chap0
Vulnerable:	Star Host Design, LLC phpMoneyBooks 1.0.3

Not Vulnerable:

Security Discussion

phpMoneyBooks is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary script code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible.

phpMoneyBooks 1.0.3 is vulnerable; other versions may also be affected.

Proof of Concept and Security Exploits

Attackers can use a browser to exploit these issues.

Security Solution(s)

Solution:
Updates are available. Please see the references for more information.

Security References(s)

References:

phpMoneyBooks Homepage (Star Host Design, LLC)

Emagined Security Blog featuring Dr. Eugene Schultz

Secure Web Programming
by Vizual Services