bugtraq - Re: CSS found in Movable Type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.55.0305121555530.21512@afybt.areqp.hsy.rqh>
Date: Mon, 12 May 2003 16:00:24 -0400 (EDT)
From: Jordan Wiens <jwiens@...sp.nerdc.ufl.edu>
To: DarkHunter <darkhunter7@...kermail.com>
Subject: Re: CSS found in Movable Type


I just tried it on an installed 2.63 MT and was unable to get the XSS to
work.  Tried the javascript samples in Name, email, homepage, and comment
field, all with no success.  MT properly elminated < > tags and left the
&lt; as &lt, not allowing any execution.

-- 
Jordan Wiens
UF Network Incident Response Team
(352)392-2061

On Mon, 12 May 2003, DarkHunter wrote:

> Summary:
> Movable Type is a decentralized web-based personal publishing system
> designed to ease maintenance of regularly-updated content. This content
> can consist of, but is not limited to, entries in a weblog or online
> journal, photographs in an online photo gallery, news headlines on a
> newspaper site, or articles in an online magazine.
>
> Details:
> Vendor's site: www.movabletype.org
>
> Vulnerable systems:
> Movable Type version 2.63 and prior.
...
> Examples:
> You can use this javascripts codes:
> &lt;script&gt;alert(document.cookie)&lt;/script&gt;