[30095] in bugtraq
Re: CSS found in Movable Type
daemon@ATHENA.MIT.EDU (Jordan Wiens)
Mon May 12 17:56:40 2003
Date: Mon, 12 May 2003 16:00:24 -0400 (EDT)
From: Jordan Wiens <jwiens@nersp.nerdc.ufl.edu>
To: DarkHunter <darkhunter7@hackermail.com>
In-Reply-To: <20030512182659.16940.qmail@www.securityfocus.com>
Message-ID: <Pine.LNX.4.55.0305121555530.21512@afybt.areqp.hsy.rqh>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
I just tried it on an installed 2.63 MT and was unable to get the XSS to
work. Tried the javascript samples in Name, email, homepage, and comment
field, all with no success. MT properly elminated < > tags and left the
< as <, not allowing any execution.
--
Jordan Wiens
UF Network Incident Response Team
(352)392-2061
On Mon, 12 May 2003, DarkHunter wrote:
> Summary:
> Movable Type is a decentralized web-based personal publishing system
> designed to ease maintenance of regularly-updated content. This content
> can consist of, but is not limited to, entries in a weblog or online
> journal, photographs in an online photo gallery, news headlines on a
> newspaper site, or articles in an online magazine.
>
> Details:
> Vendor's site: www.movabletype.org
>
> Vulnerable systems:
> Movable Type version 2.63 and prior.
...
> Examples:
> You can use this javascripts codes:
> <script>alert(document.cookie)</script>
