Kil13r-SA-20060701-2.txt

`Title:  
[Kil13r-SA-20060701-2] MoniWiki 1.1.1 Cross-Site Scripting Vulnerability  
  
Author:  
Kil13r - http://www.kil13r.info/  
  
Local / Remote:  
Remote  
  
Timeline:  
2006/06/28 - Discovery  
2006/06/28 - Vendor notification  
2006/06/30 - Vendor notification  
2006/07/01 - Release  
  
Affected version:  
MoniWiki 1.1.1 or earlier  
  
Not affected version:  
  
Description:  
MoniWiki is wiki software, but that has vulnerability.  
It can run arbitrary Javascript code by end user.  
  
If victim execute arbitrary Javascript code, attacker can steal victim's cookie.  
  
Proof of Concept code:  
None  
  
Proof of Concept example:  
http://www.victim.com/wiki.php/"><script>alert(String.fromCharCode(88,83,83,32,53580,49828,53944))</script>  
  
Proof of Concept screenshot:  
http://www.kil13r.info/sa/xss/moniwikixss.jpg  
  
-  
The Bird of Hermes is my name,  
Eating my wings to make me tame.  
`