TorrentTrader Classic "msg" Script Insertion Vulnerability

Sunday, 16 March 2008

Description:
Dominus has discovered a vulnerability in TorrentTrader Classic, which can be exploited by malicious users to conduct script insertion attacks.

Input passed to the "msg" parameter in account-inbox.php is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when e.g. viewing messages in account.php.

The vulnerability is confirmed in version 1.08. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
Dominus

Changelog:
2008-03-11: Added CVE reference.

http://secunia.com/advisories/29220/