Joostina version 1.3.0 suffers from a cross site scripting vulnerability.
5c96bd95f02ced16d35a7f78dc52958be6752a1277abb247bdff98834585337e
Hello Full-Disclosure!
I want to warn you about Cross-Site Scripting vulnerability in Joostina.
Joostina CMS - it's a fork of Joomla.
This vulnerability is similar to XSS vulnerability in Joomla 1.0.x found by
Aung Khant
(http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.0.x%7E15%5D_cross_site_scripting).
SecurityVulns ID: 11337.
-------------------------
Affected products:
-------------------------
Vulnerable are Joostina 1.3.0 and previous versions.
----------
Details:
----------
XSS (with MouseOverJacking) (WASC-08):
http://site/index.php?option=com_search&searchword=xss&ordering=%22%20onmouseover=alert(document.cookie)%20style=position:fixed;top:0;left:0;width:100%;height:100%;%22
------------
Timeline:
------------
2010.01.06 - disclosed at my site.
2010.01.07 - informed developers.
2010.01.07 - developers released a patch for this hole. Like in 2009, when I
informed them about other vulnerability, they fixed it very quickly.
I mentioned about this vulnerability at my site
(http://websecurity.com.ua/4818/).
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua