No Subject

Path: news.netfront.net!ctu-peer!news.nctu.edu.tw!netnews.chu.edu.tw!Leo.mi.ch u.edu.tw!zoonews.ee.ntu.edu.tw!FreeBSD.csie.NCTU.e du.tw!not-for-mail
From: brad.antoniewicz@foundstone.com
Newsgroups: mailing.unix.bugtraq
Subject: Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities
Date: Tue, 8 Apr 2008 23:09:14 +0800 (CST)
Organization: NCTU CSIE FreeBSD Server
Lines: 15
Sender: nobody@FreeBSD.csie.nctu.edu.tw
Message-ID: <ftg1qq$1ica$1@FreeBSD.csie.nctu.edu.tw>
NNTP-Posting-Host: freebsd.csie.nctu.edu.tw
X-Trace: FreeBSD.csie.nctu.edu.tw 1207667354 99073 140.113.17.209 (8 Apr 2008 15:09:14 GMT)
X-Complaints-To: usenet@FreeBSD.csie.nctu.edu.tw
NNTP-Posting-Date: Tue, 8 Apr 2008 15:09:14 +0000 (UTC)
Xref: news.netfront.net mailing.unix.bugtraq:26537

Title: Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities
Vendor URL: http://wiki.squeak.org/swiki Vendor Contacted: Yes

Description:
Multiple stored and reflective cross-site scripting vulnerabilities were identified in Swiki 1.5.

Reflective (example):
http://[host]:8000/<script>alert("XSS");</script>

Stored (example):
On posts to 1.append when adding new entries into the wiki, the application does not properly escape javascript code resulting in a stored cross-site scripting attack.

Credit:
Brad Antoniewicz
brad.antoniewicz@foundstone.com