bugtraq - XSS on Obedit v3.03

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070918030737.27243.qmail@securityfocus.com>
Date: 18 Sep 2007 03:07:37 -0000
From: fuxxx0rz@...il.com
To: bugtraq@...urityfocus.com
Subject: XSS on Obedit v3.03

===============================================
Obedit v3.03 - XSS Vuln.
===============================================

Author: Ishkur <fuxxx0rz [at] gmail com>
Impact: XSS and Cookie Alert
Patches: in development

-------------------------------------------
Affected Software Description:
-------------------------------------------

Application: Obedit
Version: 3.03
Vendor: http://www.oblius.com/?projects.obedit

Description:
obedit is a Flash-based rich text editor. It will allow a user to edit text much like you would in an office-like application, with simple editing features like bold, italic, justification, block indents, text color, font and size selection, links, bullets, background color, and spell checking.

--------------------
Vulns:
--------------------

open to XSS and Cookie alerts via the 'save' function.


--------------------
PoC Exploit:
--------------------

save a document with the code:
<script>javascript:alert("XSS");</script>


-------------------
Solution:
-------------------

none as of yet