CVE-2009-0660

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in Mahara versions prior to 1.0.10 and 1.1.2. The vulnerabilities are present in user-supplied profile data and blog posts, allowing arbitrary script or HTML injection through these fields [1]. This issue is distinct from CVE-2009-0487 [1].

Exploitation

An attacker can exploit these vulnerabilities by submitting crafted JavaScript/HTML payloads via the profile fields (such as display name, bio, etc.) or blog entry content. No special network position is required beyond normal web access, and the attack does not require authentication, as profiles and blogs can be viewed by any site visitor. The injected content is stored and later executed when other users visit the attacker's profile or blog page.

Impact

Successful exploitation allows the attacker to execute arbitrary HTML and JavaScript in the context of the victim's browser when viewing the attacker's profile or blog. This can lead to session hijacking, data theft (including cookies and tokens), or defacement of the Mahara application for targeted users.

Mitigation

The vulnerabilities are fixed in Mahara versions 1.0.10 and 1.1.2, released on 10 March 2009 [1][2]. Users are strongly recommended to upgrade to these versions. No workaround is described in the available references.