Foswiki Cross Site Scripting (XSS) Exploit Title: Foswiki Cross Site Scripting Date: 2.02.2012 Author: Sony Software Link: http://foswiki.org/ Google Dorks: intext:powered by foswiki Web Browser: Mozilla Firefox Blog: http://st2tea.blogspot.com PoC: http://st2tea.blogspot.com/2012/02/foswiki-cross-site-scripting.html Key Points: Vulnerability: XSS Affected System: Foswiki Vulnerable Fields: "My homepage", "Comment", etc. Google Search: Sites using Foswiki (edu, gov, org domains) are vulnerable Comments: The PoC link was deleted but is being tracked. A hotfix is being developed via the registration process. There is a general mechanism to mitigate XSS more broadly. References related to the vulnerability include: - http://foswiki.org/Tasks/Item11501 - http://foswiki.org/Support/SecurityAlert-CVE-2012-1004