[Full-disclosure] ExpressionEngine Persistent Cross-Site Scripting
adam_baldwin at ngenuity-is.com
Sun Mar 22 23:28:52 GMT 2009
nGenuity Information Services - Security Advisory
Advisory ID: NGENUITY-2009-003 - ExpressionEngine Persistent Cross-Site Scripting
Application: ExpressionEngine (1.6.4 (possibly earlier)-1.6.6)
Vendor: EllisLab, INC
Vendor website: http://www.expressionengine.com <http://www.transparent-tech.com/>
Author: Adam Baldwin (adam_baldwin at ngenuity-is.com)
"ExpressionEngine is a flexible, feature-rich content management system
that empowers thousands of individuals, organizations, and companies
around the world to easily manage their website." 
While setting a display avatar in the user control panel, avatar names
are not validated for invalid input. User input is then rendered, unaltered
into any browser that displays that members avatar.
Here is an example of an avatar name that will display an alert to any visitor
that views the users profile.
 - http://expressionengine.com/
IV. VENDOR COMMUNICATION
1.17.2009 - Vendor Notified
1.18.2009 - Initial vendor communication (details requested)
1.18.2009 - Steps to reproduce provided to vendor
1.21.2009 - Vendor response with public update "shortly"
1.22.2009 - Vendor releases 1.6.7 which addresses this vulnerability
Copyright (c) 2008 nGenuity Information Services, LLC
Full-Disclosure is hosted and sponsored by Secunia.