|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
fuxxx0rz
gmail.com
Date: Mon Sep 17 2007 - 22:07:37 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
===============================================
Obedit v3.03 - XSS Vuln.
===============================================
Author: Ishkur <fuxxx0rz [at] gmail com>
Impact: XSS and Cookie Alert
Patches: in development
-------------------------------------------
Affected Software Description:
-------------------------------------------
Application: Obedit
Version: 3.03
Vendor: http://www.oblius.com/?projects.obedit
Description:
obedit is a Flash-based rich text editor. It will allow a user to edit text much like you would in an office-like application, with simple editing features like bold, italic, justification, block indents, text color, font and size selection, links, bullets, background color, and spell checking.
--------------------
Vulns:
--------------------
open to XSS and Cookie alerts via the 'save' function.
--------------------
PoC Exploit:
--------------------
save a document with the code:
<script>javascript:alert("XSS");</script>
-------------------
Solution:
-------------------
none as of yet
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]