Wordtrans wordtrans-web wordtrans.php cross-site scripting
| wordtrans-web-php-xss (10059) |  Medium Risk |
Description:
Wordtrans is vulnerable to cross-site scripting, caused by an input validation error in the wordtrans-web package, which is a PHP-based Web interface for Wordtrans. A remote attacker could create a malicious URL link containing script embedded within parameters to the wordtrans.php script, which would be executed in the victim's Web browser in the security context of the hosting site, once the link is clicked.
Platforms Affected:
- Debian, Debian Linux 2.2
- RedHat, Linux 7
- RedHat, Linux 7.1
- RedHat, Linux 7.2
- RedHat, Linux 7.3
- WoltLab, Wordtrans 1.1pre9 and prior
Remedy:
Upgrade to the latest version of Wordtrans (1.1pre10 or later), available from the Wordtrans Web page. See References.
For Red Hat Linux 7.3: Upgrade to the latest wordtrans package (1.1pre8-11 or later), as listed in RHSA-2002:188-08. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- Guardent Client Advisory September 6, 2002, Guardent CLIENT ALERT - Multiple wordtrans-web Vulnerabilities at http://www.guardent.com/comp_news_wordtrans-web.html#.
- Wordtrans Web site, Multi Language Word Translator (wordtrans) at http://wordtrans.sourceforge.net/index.php?english=1.
- BID-5671: Wordtrans-web Remote Command Execution Vulnerability
- BID-5674: Wordtrans-web Script Injection Vulnerability
- CVE-2002-0837: wordtrans 1.1pre8 and earlier in the wordtrans-web package allows remote attackers to (1) execute arbitrary code or (2) conduct cross-site scripting attacks via certain parameters (possibly dict) to the wordtrans.php script.
- RHSA-2002-188: New wordtrans packages fix remote vulnerabilities
Reported:
Sep 06, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net