Baby Gekko URL Cross-Site Scripting Vulnerability

by Carol~ Moderator - 5/3/12 8:07 AM

In Reply to: VULNERABILITIES / FIXES - May 03, 2012 by Carol~ Moderator

Release Date : 2012-05-03

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Baby Gekko 1.x

Description:
Gjoko Krstic has discovered a vulnerability in Baby Gekko, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input appended to the URL after admin/index.php is not properly sanitised in admin/login.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 1.1.5c. Other versions may also be affected.

Solution:
Update to version 1.2.0.

Provided and/or discovered by:
Gjoko Krstic.

Original Advisory:
ZSL-2012-5086:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5086.php

Baby Gekko:
http://www.babygekko.com/site/news/general/baby-gekko-v1-2-0-released-with-3rd-party-independent-security-testing-performed-by-zero-science-lab.html

http://secunia.com/advisories/49023/