CVE-2009-0664

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in Mahara versions 1.0.x before 1.0.11 and 1.1.x before 1.1.3. The flaws occur when user-supplied input is not properly sanitized before being stored and later rendered. Specifically, the (1) introduction field in a user profile and (2) an arbitrary text block in a user view allow an attacker to inject arbitrary web script or HTML [1].

Exploitation

An attacker with the ability to edit their own user profile or create a user view can inject malicious script into the introduction field or an arbitrary text block. No special network position or authentication is required beyond a standard user account. The injected content is stored on the server and then rendered in the browser of any user who views the affected profile or view, leading to a stored (persistent) XSS attack [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking, stealing sensitive information, or performing actions on behalf of the victim within the Mahara application. The impact is limited to the scope of the affected user's privileges [1].

Mitigation

The vulnerability is fixed in Mahara versions 1.0.11 and 1.1.3, which were released on the date of the security announcement [1]. Users are strongly advised to upgrade immediately. No workaround or mitigation short of patching has been identified in the available references.