[转载]Jaws Glossary Action v 0.4 - 0.5.1跨站脚本漏洞

信息来源：nah@suckea.com

STATUS: The vendor has been contacted, fixed in cvs.

Jaws is a Framework and Content Management System for building dynamic
web sites. It aims to be User Friendly
giving ease of use and lots of ways to customize web sites, but at the
same time is Developer Friendly,
it offers a simple and powerful framework to hack your own modules.

TECHNICAL INFO
================================================================

The Glossary gadget doesn't filter dangerous characters in the argument
view or ViewTerm ( according to the version)
allowing the instertion of items from
"<script>alert(document.cookie)</script> to more complex situations.

Example:

v0.5.x:
http://url.com/index.php?gadget= ... amp;term=<script
src=some script</script>
v 0.4:
http://url.com/index.php?gadget= ... amp;term=<script
src=some script></script>

An attacker may leverage this issue to have arbitrary script code
executed in the browser of an unsuspecting user.
This may facilitate the theft of cookie-based authentication credentials
as well as other attacks.

VULNERABLE VERSIONS
---------------------------------------------------------------
0.4-0.5.1(Latest version)

---------------------------------------------------------------
Contact information
:Paulino Calderon
:nah@suckea.com
:http://nah.suckea.com/