Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

XSS Bug in Jaws Glossary Action: ViewTerm ( v 0.4 - 0.5.1 (latest version))
From: Nah <nah () suckea com>
Date: Sat, 28 May 2005 23:04:18 -0700

XSS Bug in Jaws Glossary( v 0.4 - 0.5.1 (latest version))

STATUS: The vendor has been contacted, fixed in cvs.

Jaws is a Framework and Content Management System for building dynamic web sites. It aims to be User Friendly giving ease of use and lots of ways to customize web sites, but at the same time is Developer Friendly,
it offers a simple and powerful framework to hack your own modules.

TECHNICAL INFO
================================================================

The Glossary gadget doesn't filter dangerous characters in the argument view or ViewTerm ( according to the version) allowing the instertion of items from "<script>alert(document.cookie)</script> to more complex situations.

Example:

v0.5.x:
http://url.com/index.php?gadget=Glossary&action=ViewTerm&term=<script src=some script</script>
v 0.4:
http://url.com/index.php?gadget=Glossary&action=view&term=<script src=some script></script>


An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

VULNERABLE VERSIONS
---------------------------------------------------------------
0.4-0.5.1(Latest version)


---------------------------------------------------------------
Contact information
:Paulino Calderon
:nah () suckea com
:http://nah.suckea.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • XSS Bug in Jaws Glossary Action: ViewTerm ( v 0.4 - 0.5.1 (latest version)) Nah (May 28)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]