|
|
-######### [Saved] - [27-07-2008/13:10:02]
# .: Multiple Cross-Site Scripting Vulnerabilities in Web Wiz Rich Text Editor version 4.02
# .: [Author] CSDT
# .: [Affected versions] http://www.webwizguide.com/ - Web Wiz Rich Text Editor (RTE) 4.02
# .: [Credit] The disclosure of these issues has been credited to autehoker of CSDT
# =F7_____________________________________________________________________________________________=88
# .: [Script Description]
# (Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in
# Web Wiz Rich Text Editor (RTE) 4.02 and earlier, and 3.x versions, allow remote attackers
# to inject arbitrary web scripting. This flaw exists because the application does not validate
# the Link Type ( "Email" ) variables upon submission to the RTE_popup_link.asp script.
# This could allow a user to create a specially craftedURL that would execute arbitrary code
# in a user's browser within the trust relationship between the browser and the server,
# leading to a loss of integrity.
# =F7_____________________________________________________________________________________________=88
# .: [Classification]
# Attack Type: Input Manipulation
# Impact: Loss of Integrity
# Fix: N/A Public release vulnz: {27-07-2008 Sun}
# Class Input Validation Error
# =F7_____________________________________________________________________________________________=88
# .: [Solution]
# Upgrade to version 4.03 or higher, as it has been reported to fix this vulnerability.
# An upgrade is required as there are no known workarounds.
# Actual Version: Web Wiz Rich Text Editor (RTE) 4.02
# =F7_____________________________________________________________________________________________=88
# .: [References]
# Original Advisory http://depo2.nm.ru/WebWiz_Rich_Text_Editor_v4.02_XSS.txt
# Related Depo2 BugTracker: http://depo2.nm.ru/WebWiz_Rich_Text_Editor_v4.02_XSS.txt
# =F7_____________________________________________________________________________________________=88
# .: [Manual Testing Notes]
# =F7
# Web Wiz Rich Text Editor version 4.02 // RTE_popup_link.asp
#
# function initialise(){
# var selectedRange = window.opener.document.getElementById('WebWizRTE').contentWindow.window.getSelection().toString();
# //Use editor selected range to fill text boxes
# if (selectedRange != undefined){
# document.getElementById('URL').value = selectedRange
# document.getElementById('email').value = selectedRange
# }
# =F7
# Select Link Type: Email - {Email value not filtered}
# =A4 span id="mailLink"
# =A4 input name="email" onfocus="document.forms.frmLinkInsrt.Submit.disabled=false;
# //Line 65 post back If Request.Form("URL") <> "" OR Request.Form("email") <> "" AND Request.Form("postBack") Then
# =F7
# =F7_____________________________________________________________________________________________=88
# .: [Script Download] {Free lisans: http://www.webwizguide.com/download/download.asp?DL=rte}
# .: [XSS] U-Code %3C/textarea%3E'%22%3E%3Cscript%3Ealert('document.cookie')%3C/script%3E
# .: [XSS] N-Code '"> {XSSing.Com - XSS CHEATS Auth. Depo2}
# .: [ScreenShot] http://depo2.co.cc/WebWiz_Rich_Text_Editor_v4.02_XSS.jpg
# .: [Demo] http://www.webwizguide.com/webwizrichtexteditor/demo/RTE_popup_link.asp
# =F7_____________________________________________________________________________________________=88
# .: [Greetings]
# =F7
# .:[shoutz] L0cKed, Elrohir, xo7, Th3.Azad, Depo2, The_keSsk!N, MadNet, hayalperest, K4R4B3L4
# =F7 ankuN, row3r, LekHe, M3M4T!, Dr.ExPERT, MuR@T, Bigboss, EjDeRx7, Arslan Yabgu, t=FCrk_=FCz, by.s.s,
# makmanaman, İsimsizCod3r, hackerali, **De-PreaM**, DarKWorM, Brian, |_GeCCe_|, BİXİi , EkBeR-I DeRYa
# =F7
# .: [SS] CSDT- Atabeyler TIM - Atabeyler.Org
-########_______________________________________________________________________________________ ####
