`# Exploit Title: Foswiki Cross Site Scripting
# Date: 2.02.2012
# Author: Sony
# Software Link: http://foswiki.org/
# Google Dorks: intext:powered by foswiki
# Web Browser : Mozilla Firefox
# Blog : http://st2tea.blogspot.com
# PoC:
http://st2tea.blogspot.com/2012/02/foswiki-cross-site-scripting.html
..................................................................
What is Foswiki?
Foswiki launched in October 2008 after TWiki..[<a href="
http://en.wikipedia.org/wiki/TWiki">more..</a>]
About TWiki cross site scripting you can read here:
http://packetstormsecurity.org/files/109246/TWiki-Cross-Site-Scripting.html
Well, in Foxwiki:
http://foswiki.org/Main/SonyStyles
http://1.bp.blogspot.com/-XoubozNduj8/TysBtx0o1lI/AAAAAAAAAYs/a9eZhpgfrOU/s1600/%25D0%2591%25D0%25B5%25D0%25B7%25D1%258B%25D0%25BC%25D1%258F%25D0%25BD%25D0%25BD%25D1%258B%25D0%25B9.jpg
In fields "My homepage","Comment",etc..
And yes, a lot of sites with Foswiki vuln.. to xss.
You can see in Google:
powered by foswiki site:edu
uchicago.edu,stanford.edu,umich.edu,mit.edu..etc..
powered by foswiki site:gov
powered by foswiki site:org
etc..
`