[Secure-testing-team] Bug#736821: fookebox: no input validation for search function (XSS)

[Julius Seemayer]

Package: fookebox
Version: 0.6.1-1
Severity: normal
Tags: security

Hi,


the  search  function  of  fookebox MPD web interface suffers from classic XSS
vulnerability;  a  search  string  like  '<script>alert(/xss/)</script>'  will
launch  an  alert  box.   It's  using  AJAX  and POST, so I'm not sure if it's
exploitable easily from remote hosts.


Cheers,

	Julius



-- System Information:
Debian Release: 7.3
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash