AOH :: HP Unsorted S :: BX2713.HTM

Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities



Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities
Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities



Title: Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities
Vendor URL: http://wiki.squeak.org/swiki Vendor Contacted: Yes

Description:
Multiple stored and reflective cross-site scripting vulnerabilities were identified in Swiki 1.5.

Reflective (example):
">http://[host]:8000/

Stored (example):
On posts to 1.append when adding new entries into the wiki, the application does not properly escape javascript code resulting in a stored cross-site scripting attack.

Credit:
Brad Antoniewicz
brad.antoniewicz@foundstone.com

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.