joi, 2 februarie 2012

Foswiki Cross Site Scripting

# Exploit Title: Foswiki Cross Site Scripting
# Date: 2.02.2012
# Author: Sony

# Software Link: http://foswiki.org/
# Google Dorks: intext:powered by foswiki
# Web Browser : Mozilla Firefox

# Blog : http://st2tea.blogspot.com
# PoC:
http://st2tea.blogspot.com/2012/02/foswiki-cross-site-scripting.html

..................................................................

What is Foswiki?

Foswiki launched in October 2008 after TWiki..
[more..]

About TWiki cross site scripting you can read here:


http://packetstormsecurity.org/files/109246/TWiki-Cross-Site-Scripting.html

Well, in Foxwiki:

http://foswiki.org/Main/SonyStyles


In fields "My homepage","Comment",etc..

And yes, a lot of sites with Foswiki vuln to xss.

You can see in Google:


powered by foswiki site:edu

uchicago.edu,stanford.edu,umich.edu,mit.edu..etc..

powered by foswiki site:gov

powered by foswiki site:org

etc..

4 comentarii:

Paul spunea...

Not sure why the link to the PoC - http://foswiki.org/Main/SonyStyles - was deleted, but we're tracking this problem at http://foswiki.org/Tasks/Item11498

Paul spunea...

Hotfix for vulnerability via registration process is being developed at http://foswiki.org/Tasks/Item11501

http://foswiki.org/Tasks/Item11498 is more general work to create a new mechanism that will mitigate against XSS more generally.

Sony spunea...

Paul,thank you very much for your help:)

Paul spunea...

foswiki.org/Support/SecurityAlert-CVE-2012-1004

Trimiteţi un comentariu

Reţineţi: Numai membrii acestui blog pot posta comentarii.