AOH :: HP Unsorted O :: BX3883.HTM

Owl <=0.95, CVE-2008-3100 XSS
Cross Site Scripting (XSS) in Owl <=0.95, CVE-2008-3100
Cross Site Scripting (XSS) in Owl <=0.95, CVE-2008-3100

This is a MIME-formatted message.  If you see this text it means that your
E-mail software does not support MIME-formatted messages.
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

Cross Site Scripting (XSS) in Owl <=0.95, CVE-2008-3100


Owl is a multi user document repository (knowledgebase) system for
publishing files/documents onto the web. The application is vulnerable
to simple Cross Site Scripting, which can be used for several isues

Assuming Owl is installed on http://localhost/Owl/, one can inject 
JavaScript with:

Replace your owl.lib.php with the version from*checkout*/owl/owl-0.90/lib/owl.lib.php 

Disclosure Timeline:
2008-07-27 Vendor contacted
2008-07-28 Vendor: fixed issue in cvs / no need for new stable release
2008-07-28 Advisory published

CVE Information:
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2008-3100 to this issue. This is a candidate for inclusion in
the CVE list (, which standardizes names for 
security problems. 

Credits and copyright:
This vulnerability was discovered by Fabian Fingerle (published with
help from Hanno Boeck ( It's licensed under the 
creative commons attribution license 3.0.

Fabian Fingerle, 2008-07-28, 

_GPG_ 3D17 CAC8 1955 1908 65ED  5C51 FDA3 6A09 AB41 AB85
_chaos events near stuttgart_
Content-Type: application/pgp-signature; name="signature.asc"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename=signature.asc

Version: GnuPG v2.0.9 (GNU/Linux)


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to