CVE-2004-1397

Vulnerability

UseModWiki 1.0 contains a cross-site scripting (XSS) vulnerability due to an input validation flaw in wiki.pl. An attacker can inject arbitrary web script or HTML by passing a malicious argument to the script. The advisory [1] confirms this affects UseModWiki 1.0.

Exploitation

An attacker can exploit this vulnerability remotely without authentication by crafting a URL such as http://[victim]/cgi-bin/wiki.pl?. If a victim clicks the link, the injected script executes in their browser session in the context of the affected site [1].

Impact

Successful exploitation allows an attacker to execute arbitrary script code in a user's browser, potentially leading to session hijacking, defacement, or theft of sensitive information [1].

Mitigation

As of the advisory publication date (2004-12-09), no fix was available from the vendor. No workaround was known [1]. Users should consider upgrading to a patched version if one becomes available or applying external input filtering.