Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: CSS found in Movable Type
From: Jordan Wiens <jwiens () nersp nerdc ufl edu>
Date: Mon, 12 May 2003 16:00:24 -0400 (EDT)

I just tried it on an installed 2.63 MT and was unable to get the XSS to
work.  Tried the javascript samples in Name, email, homepage, and comment
field, all with no success.  MT properly elminated < > tags and left the
&lt; as &lt, not allowing any execution.

-- 
Jordan Wiens
UF Network Incident Response Team
(352)392-2061

On Mon, 12 May 2003, DarkHunter wrote:

Summary:
Movable Type is a decentralized web-based personal publishing system
designed to ease maintenance of regularly-updated content. This content
can consist of, but is not limited to, entries in a weblog or online
journal, photographs in an online photo gallery, news headlines on a
newspaper site, or articles in an online magazine.

Details:
Vendor's site: www.movabletype.org

Vulnerable systems:
Movable Type version 2.63 and prior.
...
Examples:
You can use this javascripts codes:
&lt;script&gt;alert(document.cookie)&lt;/script&gt;


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]