Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PKs Movie Database version 3.0.3 (SQL/XSS)

Joomla <= v1.0.14- RC1(Index. php) Remote File Inclusion Exploit

Joovili <= v.2.1 (members_help. php) Remote File İnclude Vulnerability

Blackboard (id) Remote SQL Injection

From:	MustLive <mustlive_(at)_websecurity.com.ua>
Date:	10.02.2008
Subject:	Vulnerabilities in CMS SiteEdit

Здравствуйте 3APA3A!

Сообщаю вам о найденных мною Cross-Site Scripting уязвимостях в CMS SiteEdit.

XSS:

В скрипте thanks в параметрах formobj_email, formobj_message, formobj_edit, formobj_name,
formobj_company, formobj_jobtitle, formobj_site, formobj_address, formobj_telephone, formobj_img,
formobj_GoTo, autoreply_text.

http:
//site/thanks?formobj_email=%22%3E%3Cscript%3Ealert(document.
cookie)%3C/script%3E

В скрипте registration в параметрах login, email, first_name, last_name.

http:
//site/registration?login=%22%3E%3Cscript%3Ealert(document.
cookie)%3C/script%3E

Дополнительная информация о данных уязвимостях у меня на сайте:
http://websecurity.com.ua/1811/

Best wishes & regards,
MustLive
Администратор сайта
http://websecurity.com.ua