BitWeaver <= 2.7 Non Persistent XSS Vulnerability
Posted on 10 March 2010
================================================= BitWeaver <= 2.7 Non Persistent XSS Vulnerability ================================================= # Exploit Title: BitWeaver <= 2.7 Non Persistent XSS # Date: 10/03/2010 # Author: EgoPL # Software Link: http://www.bitweaver.org/ # Version: BitWeaver <= 2.7 # Tested on: Debian + Apache but it's OS independent. # Description of the webapp: Bitweaver is a free and open source web application framework and content management system. Its speed and power are ideal for large-scale community websites and corporate applications, but it is simple enough for non-technical small site users to set up and administrate. It comes fully featured on install but is modular and easy to extend. # XSS by the Wikipedia. Cross-site scripting holes are web application vulnerabilities which allow attackers to bypass client-side security mechanisms normally imposed on web content by modern browsers. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. Cross-site scripting attacks are therefore a special case of code injection. # Proof of concept In register: http://www.example.org/users/register.php 1>"><script>alert("EgoPL says: I'm a XSS"</script> There are more XSS for example in the sort_mode etc but is your work find it if you want to use it. # ~ - [ [ : Inj3ct0r : ] ]
