Home page logo
/

bugtraq logo Bugtraq mailing list archives

Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities
From: brad.antoniewicz () foundstone com
Date: 7 Apr 2008 23:27:55 -0000

Title: Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities 
Vendor URL: http://wiki.squeak.org/swiki Vendor Contacted: Yes

Description:
Multiple stored and reflective cross-site scripting vulnerabilities were identified in Swiki 1.5. 

Reflective (example):
http://[host]:8000/<script>alert("XSS");</script>

Stored (example):
On posts to 1.append when adding new entries into the wiki, the application does not properly escape javascript code 
resulting in a stored cross-site scripting attack. 

Credit: 
Brad Antoniewicz
brad.antoniewicz () foundstone com


  By Date           By Thread  

Current thread:
  • Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities brad . antoniewicz (Apr 08)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault