Bugtraq mailing list archives
Re: CSS found in Movable Type
From: Jordan Wiens <jwiens () nersp nerdc ufl edu>
Date: Mon, 12 May 2003 16:00:24 -0400 (EDT)
I just tried it on an installed 2.63 MT and was unable to get the XSS to work. Tried the javascript samples in Name, email, homepage, and comment field, all with no success. MT properly elminated < > tags and left the < as <, not allowing any execution. -- Jordan Wiens UF Network Incident Response Team (352)392-2061 On Mon, 12 May 2003, DarkHunter wrote:
Summary: Movable Type is a decentralized web-based personal publishing system designed to ease maintenance of regularly-updated content. This content can consist of, but is not limited to, entries in a weblog or online journal, photographs in an online photo gallery, news headlines on a newspaper site, or articles in an online magazine. Details: Vendor's site: www.movabletype.org Vulnerable systems: Movable Type version 2.63 and prior.
...
Examples: You can use this javascripts codes: <script>alert(document.cookie)</script>
Current thread:
- CSS found in Movable Type DarkHunter (May 12)
- Re: CSS found in Movable Type Jordan Wiens (May 12)
- Re: CSS found in Movable Type Jordan Wiens (May 12)
- <Possible follow-ups>
- Re: CSS found in Movable Type ben (May 12)
- Re: CSS found in Movable Type Jordan Wiens (May 12)