Информационная безопасность
[RU] switch to English

Дополнительная информация

  Ежедневная сводка ошибок в Web-приложениях (PHP, ASP, JSP, CGI, Perl )

  Bitweaver source code disclosure, arbitrary file upload

  milliscripts (dir.php) Cross-Site Scripting Vulnerability

  Instant Softwares DatingSite SQL Injection

  [HSC Security Group] Multiple CSRF in Joomla all versions - Complete compromise

From:Audun Larsen <audun_(at)_munio.no>
Date:2 января 2008 г.
Subject:Cross-Site Scripting (XSS) in phpWebSite 1.4.0 search

Cross-Site Scripting (XSS) in phpWebSite 1.4.0 search

Author: Audun Larsen (larsen at xqus dot com)
Date: Dec 29, 2007

--AFFECTED SOFTWARE--------------------------

Name: phpWebSite
Version: 1.4.0
Release date: Dec 11, 2007

Developed by the Web Technology Group at Appalachian State University,
phpWebSite provides a complete web site content management system ( CMS ).
All client output is XHTML 1.0 and meets the
W3C's Web Accessibility Initiative requirements.


The phpWebSite CMS is vulnerable to a Non-Persistent (or reflected)
Cross-Site Scripting attack. The problem exists because of the lack
of properly escaping user input before using it to generate links on
the search result page.

--PROOF OF CONCEPT---------------------------



Dec 29, 2007: Bug found
Dec 29, 2007: Vendor notified
DEc 31, 2007: Vendor reports that the bug is fixed
Jan 1 , 2008: Posted to Bugtraq


The information in this advisory and any of its demonstrations is provided
"as is" without warranty of any kind.

Copyright © 2007 Audun Larsen, some rights reserved:

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород