bugtraq - Wikepage Wiki v.2007-2 Cross-Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080418081302.24395.qmail@securityfocus.com>
Date: 18 Apr 2008 08:13:02 -0000
From: darkz.gsa@...il.com
To: bugtraq@...urityfocus.com
Subject: Wikepage Wiki v.2007-2 Cross-Site Scripting

Wikepage Wiki v.2007-2 Cross-Site Scripting

Author: Gerendi Sandor Attila
Date: April 09, 2008
Package: Wikepage Wiki
Product homepage: http://wikepage.org/
Versions Affected: v.2007-2 (Other versions may also be affected)
Severity: XSS

Input passed to "wiki" in "index.php" is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when malicious data is viewed.

Example:
http://somehost/wikepage_2007_2/index.php?wiki=test%22%20onclick=%22alert(1)%22%20%20bla=%22

Status:
1. Contacted the author at April 09, 2008 via sourceforge tracker (no response).