# Date: 2.02.2012
# Author: Sony
# Software Link: http://foswiki.org/
# Google Dorks: intext:powered by foswiki
# Web Browser : Mozilla Firefox
# Blog : http://st2tea.blogspot.com
# PoC:
http://st2tea.blogspot.com/2012/02/foswiki-cross-site-scripting.html
..................................................................
What is Foswiki?
Foswiki launched in October 2008 after TWiki..[more..]
About TWiki cross site scripting you can read here:
http://packetstormsecurity.org/files/109246/TWiki-Cross-Site-Scripting.html
Well, in Foxwiki:
http://foswiki.org/Main/SonyStyles
In fields "My homepage","Comment",etc..
And yes, a lot of sites with Foswiki vuln to xss.
You can see in Google:
powered by foswiki site:edu
uchicago.edu,stanford.edu,umich.edu,mit.edu..etc..
powered by foswiki site:gov
powered by foswiki site:org
etc..
4 comentarii:
Not sure why the link to the PoC - http://foswiki.org/Main/SonyStyles - was deleted, but we're tracking this problem at http://foswiki.org/Tasks/Item11498
Hotfix for vulnerability via registration process is being developed at http://foswiki.org/Tasks/Item11501
http://foswiki.org/Tasks/Item11498 is more general work to create a new mechanism that will mitigate against XSS more generally.
Paul,thank you very much for your help:)
foswiki.org/Support/SecurityAlert-CVE-2012-1004
Trimiteți un comentariu
Rețineți: Numai membrii acestui blog pot posta comentarii.