0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Wiki Web Help 0.3.9 Multiple Stored XSS Vulnerabilities
[# Exploit Title: Multiple Stored XSS Vulnerabilities in Wiki Web Help.
# Date: 23/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://wikiwebhelp.org
# Software Link: http://sourceforge.net/projects/wwh/files/wwh-0.3.9.7z/download
# Version: 0.3.9
#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar
About the Application:
======================
AJAX based wiki designed to operate like a desktop help viewer(chm).
Vulnerability Description
=========================
1. Stored XSS in Edit Tags.
Steps to reproduce the issue:
1.1. Click "Edit Tags"
1.2. In the "Tags" field insert the Javascript payload: <img src='1.jpg'onerror=javascript:alert("XSS")>
1.3. Click the "Update" button.
2. Stored XSS in Node Name.
Steps to reproduce the issue:
2.1. Right click on an object in the Contents tree on the left side of the page.
2.2. In the "Node Option" window select "Add".
2.3. In the "New Page Name" field insert the Javascript payload: <img src='1.jpg'onerror=javascript:alert("XSS")>
* Both XSS will be triggered on all users visiting the Wiki.
3. Stored XSS in Page Body (href).
Steps to reproduce the issue:
3.1. Choose a Page.
3.2. Click "Edit".
3.2. In the Page editor insert: [javascript:alert(/XSS/),Click Me]
3.3. Click the "Save" button.
XSS Will be triggerd once the user clicks on the link.
# 0day.today [2024-11-15] #