[Full-disclosure] XSS Bug in Jaws Glossary Action: ViewTerm ( v 0.4 - 0.5.1 (latest version))

XSS Bug in Jaws Glossary( v 0.4 - 0.5.1 (latest version))

STATUS: The vendor has been contacted, fixed in cvs.

Jaws is a Framework and Content Management System for building dynamic 
web sites. It aims to be User Friendly
giving ease of use and lots of ways to customize web sites, but at the 
same time is Developer Friendly,
it offers a simple and powerful framework to hack your own modules.

TECHNICAL INFO
================================================================

The Glossary gadget doesn't filter dangerous characters in the argument 
view or ViewTerm ( according to the version)
allowing the instertion of items from 
"<script>alert(document.cookie)</script> to more complex situations.

Example:

v0.5.x:
http://url.com/index.php?gadget=Glossary&action=ViewTerm&term=<script 
src=some script</script>
v 0.4:
http://url.com/index.php?gadget=Glossary&action=view&term=<script 
src=some script></script>


An attacker may leverage this issue to have arbitrary script code 
executed in the browser of an unsuspecting user.
This may facilitate the theft of cookie-based authentication credentials 
as well as other attacks.

VULNERABLE VERSIONS
---------------------------------------------------------------
0.4-0.5.1(Latest version)


---------------------------------------------------------------
Contact information
:Paulino Calderon
:nah@suckea.com
:http://nah.suckea.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/