[42113] in bugtraq
Advisory:XSS vulnerability on WebWiz Forums <= 6.34
daemon@ATHENA.MIT.EDU (nukedx@nukedx.com)
Wed Jan 11 20:05:51 2006
Message-ID: <20060111040914.pzttf4hhvfac0cw0@webmail.nukedx.com>
Date: Wed, 11 Jan 2006 04:09:14 -0600
From: nukedx@nukedx.com
To: bugtraq@securityfocus.com
MIME-Version: 1.0
Content-Type: text/plain;
charset=ISO-8859-9
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
--Security Report--
Advisory:XSS vulnerability on WebWiz Forums <= 6.34 (search_form.asp)
---
Date: 08/01/06 07:19 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx_at_nukedx.com
Web: http://www.nukedx.com
}
---
About: Via this method the WebWiz Forums <= 6.34 are being subjected to an
attack namely XSS attack a.k.a "Cross Site Scripting".The attacker, with the
help of user clicking to the exploited, is able to inject a code with
the link.
Example &
How:http://[site]/[webwizdir]/search_form.asp?ReturnPage=Search&search=XSS&searchMode=allwords&searchIn=Topic&forum=0&searchSort=dateDESC&SearchPagePosition=1
Solution: This vulnerability has been fixed WebWiz products >= 7.01
Regards,
From the NWPX team,
nuker a.k.a nukedx
