Advisories » WebCT Mail and Discussion Board Message Handing Remote Cross-Site Scripting Vulnerability

Release Date:	07/03/2008	Severity:	Less Critical
SecWatch Advisory:	SWID1020585	Cause:	Input validation error
Solution Status:	Unpatched	Impact:	Cross Site Scripting
Exploit Status:	None Available	Access Vector:	From remote
Affected Software:	WebCT Campus Edition 4.x
Original Advisory:	http://www.balupton.com/documents/webct_exploits.txt
CVE:	CVE-2008-1225
Secunia:	SA29227
Bugtraq ID:	BID#28107

Description:

An input validation vulnerability in WebCT Campus Edition has been reported, which can be exploited by remote users to conduct script insertion attacks.

User-supplied input passed as mail or discussion board messages with "Don't wrap text" enabled is not properly sanitised before being stored. This can be exploited to execute arbitrary script code in the security context of an affected website when the data is viewed, as a result the code will be able to access any of the target user's cookies, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

Affected:

WebCT Campus Edition version 4.1.5.8. Other versions may also be affected.

Solution:

There was no vendor-supplied solution at the time of entry.

Edit source code manually to ensure user-supplied input is correctly sanitised.

Filter malicious characters and character sequences via a HTTP proxy or firewall with URL filtering capabilities.

Credits:

Benjamin "balupton" Lupton

Free Vulnerability Notification Service

Receive free instant and customisable notifications of new vulnerabilities or exploits via e-mail, web or RSS feeds. Click here for more information.