[36902] in bugtraq
XXS in fusetalk forum
daemon@ATHENA.MIT.EDU (Matthew Oyer)
Wed Oct 13 12:59:08 2004
From: "Matthew Oyer" <root@spiffomatic64.com>
To: <bugtraq@securityfocus.com>
Date: Wed, 13 Oct 2004 00:03:31 -0400
Message-ID: <000101c4b0d9$9b0a45b0$6500a8c0@spiff>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Vendor : fusetalk
URL : http://www.fusetalk.com/
Version: 4.0
Risk : Cross site scripting
Description: Fusetalk is a discussion forum solution that provides a
powerful and simple method of web-based collaboration.
Cross site scripting: The filtering script for the img src= doesnt
filter " if preceeded by a ?. The cross site scripting works because the
<img src=" tag can be closed by a target url with " which then permits
the user to use such oneventhandles as onmouseover.
Solution: The easiest way would be to just replace all characters with
their &#xx; equivilant.
Credits: Credits goto my loving fiance, you push me todo things i never
thought possible.
Exploit: This is exploited by passing a img src with malicious
javascript.
Spiffomatic64
Hacking is an art-form
