Zend Framework 1.9.6 - Multiple Input Validation Vulnerabilities / Security Bypass

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1058998 漏洞类型
发布时间 2010-01-14 更新时间 2010-01-14
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/33525
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/37809/info

Zend Framework is prone to multiple input-validation vulnerabilities and a weakness:

- Multiple cross-site scripting issues
- An HTML-injection issue
- A security-bypass weakness

An attacker may leverage the cross-site scripting issues and HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The attacker can exploit the security-bypass weakness in conjunction with other latent vulnerabilities to bypass certain security restrictions.

Versions prior to Zend Framework 1.7.9, 1.8.5, and 1.9.7 are vulnerable. 

The following example URI is available:

http://www.example.com/index.php?lang=english&skin=&debut=0&seeAdd=1&seeNotes=&seeMess=[XSS-Vuln]