CVE-2003-1350 Business logic in n/a
Remote attackers can hijack user accounts in List Site Pro by injecting pipe characters into the bannerurl field.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2003-1350?
CVE-2003-1350 is a medium-severity vulnerability in n/a, published on 14 Oct 2007. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
List Site Pro 2.0 allows remote attackers to hijack user accounts by inserting a "|" (pipe), which is used as a field delimiter, into the bannerurl field.
Weakness: CWE-20
Which versions are affected by CVE-2003-1350?
It affects 1 product.
Products include List Site Pro List Site Pro.
How do I fix CVE-2003-1350?
No fix has been published for CVE-2003-1350 yet. Limit exposure of the affected software until one is available.
Is CVE-2003-1350 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2003-1350 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-4v27-cw49-q24f.