Summary
This host is installed with FCKeditor and is prone to multiple cross site scripting vulnerabilities.
Impact
Successful exploitation will allow attacker to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.
Impact Level: Application
Solution
Upgrade to FCKeditor version 2.6.11 or later,
For updates refer to http://ckeditor.com
Insight
Input passed via the keys and values of POST parameters to editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php is not properly sanitised in the 'print_textinputs_var()' function before being returned to the user.
Affected
FCKeditor version prior to 2.6.11
Detection
Send a crafted exploit string via HTTP GET request and check whether it is possible to read cookie or not.
References
Severity
Classification
-
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities
- AeroMail Cross Site Request Forgery, HTML Injection and Cross Site Scripting Vulnerabilities
- Aardvark Topsites <= 4.2.2 Remote File Inclusion Vulnerability
- Apache Tomcat Cross-Site Scripting and Security Bypass Vulnerabilities
- Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability
- Apache Tomcat Directory Listing and File disclosure