Zend Framework 1.9.6 – Multiple Input Validation Vulnerabilities / Security Bypass

• Exploit Database
• 164 阅读

• 作者： draic Brady
  日期： 2010-01-14
• 类别：

  • remote
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/33525/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

  source: https://www.securityfocus.com/bid/37809/info   Zend Framework is prone to multiple input-validation vulnerabilities and a weakness:   - Multiple cross-site scripting issues - An HTML-injection issue - A security-bypass weakness   An attacker may leverage the cross-site scripting issues and HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.   The attacker can exploit the security-bypass weakness in conjunction with other latent vulnerabilities to bypass certain security restrictions.   Versions prior to Zend Framework 1.7.9, 1.8.5, and 1.9.7 are vulnerable.   The following example URI is available:   http://www.example.com/index.php?lang=english&skin=&debut=0&seeAdd=1&seeNotes=&seeMess=[XSS-Vuln]