Cross-site scripting vulnerability in Crafy Syntax Live Help 2.7.3 and below

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The problem:

Users are able to insert pieces of html both in
 their name when they request livehelp and in chat sessions.
For example. If I where to input the following javascript inside a
"<"script">" tag and use it as my name.
 
window.location("http://www.cgisecurity.com/articles/xss-faq.shtml");

This would cause all online operators to goto that
 URL. This on its own may not seem to be that big of a deal to you. The
 following example is a little more malicious. If the following snippet of
 code is put between script tags and then pasted into an chat session
 with an operator it will cause CSLH to remove the first operator.
 
window.location("http://livehelp.someisp.com/livehelp/operators.php?remove=1")

Solution:

Upgrade to CSLH 2.7.4.

HNK Technology Solutions would like to thank the developer(s) of CSLH for
their quick response and fix for the problem.

John C. Hennessy
President/CTO
HNK Technology Solutions, Inc.
http://www.hnkts.net

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAv2VXT9ZtXavj78YRAiB9AJ9whkTWLcDsZW4BvAAherb+n8e8YQCgoIyB
+d78L6Bl/UoblPFmfOTXhXQ=
=oxIS
-----END PGP SIGNATURE-----
Received on Jun 04 2004