CVE-2012-3997

Vulnerability

Sticky Notes versions before 0.2.27052012.5 contain multiple cross-site scripting (XSS) vulnerabilities [1]. The paste_user and paste_lang parameters in list.php and show.php are not properly sanitized, allowing injection of arbitrary web script or HTML.

Exploitation

An attacker can exploit these vulnerabilities by crafting a malicious URL or form submission containing script code in the paste_user or paste_lang parameters. No authentication is required; the attacker only needs to trick a victim into opening the crafted link or loading the affected page in a browser.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, credential theft, or defacement of the sticky notes application.

Mitigation

The vulnerability is fixed in version 0.2.27052012.5 [1]. Users should upgrade to this version or later. No workarounds are documented in the available references.