From: Secunia Security Advisories (sec-advsecunia.com)
Date: Fri Apr 23 2004 - 06:18:24 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
pisg Script Insertion Vulnerability

SECUNIA ADVISORY ID:
SA11467

VERIFY ADVISORY:
http://secunia.com/advisories/11467/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting

WHERE:
From remote

SOFTWARE:
pisg 0.x

DESCRIPTION:
shr3kst3r has reported a vulnerability in pisg, allowing malicious
people to conduct script insertion attacks.

The problem is that nick names aren't properly sanitised before they
are stored. Nicks can contain script code or references to
administrative functions, which will be executed when an
administrative user reads the statistics.

Reportedly, this only affects few systems as most IRC servers don't
allow nicks with special characters.

SOLUTION:
Edit the source code to ensure that all input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY:
shr3kst3r

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]