Mephisto blog is vulnerable to XSS Mar 25 2007 05:52AM
Sergey Tikhonov (st haqu net)
Hello everyone!

Current bleeding-edge version of Mephisto blog is vulnerable to XSS.
Comment's author name accept javascript code. If admin approves/
rejects comments manually, he have to load all unapproved comments,
so it's possible to fetch his session id.

Example

Add new comment with the following author name: <script>alert
(document.cookie)</script>
Then from admin's overview section check this comment - you'll see
message with cookie.
If you manually approve your comments, check list of pending comments.

How to fix it

patch for <approot>/app/helpers/application_helper.rb :

5c5
< return comment.author if comment.author_url.blank?
---
> return h(comment.author) if comment.author_url.blank?

Best wishes!
Sergey Tikhonov

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus